Allocate memory for the interface addr arrays dynamically

to avoid potential overruns.

(cherry picked from commit f349e5b3fa0206cd6269df256911a73f52ff4a0b)

diff --git a/src/viced/callback.c b/src/viced/callback.c
index a10b2cdd306c0fdeb810aa0111a54a105399459b..219a3141b4b5731c8ef2ab82fc9a480320113f8d 100644 (file)
--- a/src/viced/callback.c
+++ b/src/viced/callback.c
@@ -1791,9 +1791,9 @@ struct host*              host;
 struct AFSCBFids*      afidp;
 {
        int i,j;
-       struct rx_connection*   conns[AFS_MAX_INTERFACE_ADDR];
+       struct rx_connection**  conns;
        struct rx_connection*   connSuccess = 0;
-       afs_int32                       addr[AFS_MAX_INTERFACE_ADDR];
+       afs_int32               *addr;
        static struct rx_securityClass *sc = 0;
        static struct AFSCBs tc = {0,0};
 
@@ -1810,6 +1810,10 @@ struct AFSCBFids*        afidp;
        if ( !sc )
            sc = (struct rx_securityClass *) rxnull_NewClientSecurityObject();
 
+       i = host->interface->numberOfInterfaces;
+       addr = malloc(i * sizeof(afs_int32));
+       conns = malloc(i * sizeof(struct rx_connection *));
+
        /* initialize alternate rx connections */
        for ( i=0,j=0; i < host->interface->numberOfInterfaces; i++)
        {
@@ -1856,6 +1860,9 @@ struct AFSCBFids* afidp;
                if ( conns[i] != connSuccess )
                        rx_DestroyConnection(conns[i] );
 
+       free(addr);
+       free(conns);
+
        if ( connSuccess ) return 0;    /* success */
                else return 1;          /* failure */
 }
@@ -1870,9 +1877,9 @@ MultiProbeAlternateAddress_r(host)
 struct host*           host;
 {
        int i,j;
-       struct rx_connection*   conns[AFS_MAX_INTERFACE_ADDR];
+       struct rx_connection**  conns;
        struct rx_connection*   connSuccess = 0;
-       afs_int32                       addr[AFS_MAX_INTERFACE_ADDR];
+       afs_int32               *addr;
        static struct rx_securityClass *sc = 0;
 
        /* nothing more can be done */
@@ -1888,6 +1895,10 @@ struct host*             host;
        if ( !sc )
            sc = (struct rx_securityClass *) rxnull_NewClientSecurityObject();
 
+       i = host->interface->numberOfInterfaces;
+       addr = malloc(i * sizeof(afs_int32));
+       conns = malloc(i * sizeof(struct rx_connection *));
+
        /* initialize alternate rx connections */
        for ( i=0,j=0; i < host->interface->numberOfInterfaces; i++)
        {
@@ -1934,6 +1945,9 @@ struct host*              host;
                if ( conns[i] != connSuccess )
                        rx_DestroyConnection(conns[i] );
 
+       free(addr);
+       free(cons);
+
        if ( connSuccess ) return 0;    /* success */
                else return 1;          /* failure */
 }

diff --git a/src/viced/host.c b/src/viced/host.c
index 14c9e6d3915c6fe3fdf1aecf26494b4bfff45a04..226a7946191b0b5c67ffaf4cfb702c323ff2cf89 100644 (file)
--- a/src/viced/host.c
+++ b/src/viced/host.c
@@ -956,7 +956,6 @@ struct host *h_GetHost_r(tcon)
     int held;
     struct interfaceAddr interf;
     int interfValid = 0;
-    afs_int32  buffer[AFS_MAX_INTERFACE_ADDR];
     struct Identity *identP = NULL;
     afs_int32 haddr;
     afs_int32 hport;
@@ -1934,7 +1933,6 @@ int CheckHost(host, held)
 
 {
     register struct client *client;
-    struct interfaceAddr interf;
     int code;
 
     /* Host is held by h_Enumerate */
@@ -2070,11 +2068,11 @@ struct interfaceAddr *interf;
                host->host, interf->numberOfInterfaces));
 
        number = interf->numberOfInterfaces;
-       myPort   = host->port;
-       myHost   = host->host; /* current interface address */
+       myPort = host->port;
+       myHost = host->host; /* current interface address */
 
        /* validation checks */
-       if ( number < 0 )
+       if ( number < 0 || number > AFS_MAX_INTERFACE_ADDR )
         {
                ViceLog(0,("Number of alternate addresses returned is %d\n",
                         number));