Allocate memory for the interface addr arrays dynamically

to avoid potential overruns.

diff --git a/src/viced/callback.c b/src/viced/callback.c
index bafec43dc55b095ad1f5fa299f1b3ee483fbfb19..e70682546acd5fe634f725250a487d49f2f617c6 100644 (file)
--- a/src/viced/callback.c
+++ b/src/viced/callback.c
@@ -1704,9 +1704,9 @@ int MultiBreakCallBackAlternateAddress(struct host *host, struct AFSCBFids *afid
 int MultiBreakCallBackAlternateAddress_r(struct host *host, struct AFSCBFids *afidp)
 {
        int i,j;
-       struct rx_connection*   conns[AFS_MAX_INTERFACE_ADDR];
+       struct rx_connection**  conns;
        struct rx_connection*   connSuccess = 0;
-       afs_int32                       addr[AFS_MAX_INTERFACE_ADDR];
+       afs_int32               *addr;
        static struct rx_securityClass *sc = 0;
        static struct AFSCBs tc = {0,0};
        char hoststr[16];
@@ -1724,6 +1724,10 @@ int MultiBreakCallBackAlternateAddress_r(struct host *host, struct AFSCBFids *af
        if ( !sc )
            sc = rxnull_NewClientSecurityObject();
 
+       i = host->interface->numberOfInterfaces;
+       addr = malloc(i * sizeof(afs_int32));
+       conns = malloc(i * sizeof(struct rx_connection *));
+
        /* initialize alternate rx connections */
        for ( i=0,j=0; i < host->interface->numberOfInterfaces; i++)
        {
@@ -1770,6 +1774,9 @@ int MultiBreakCallBackAlternateAddress_r(struct host *host, struct AFSCBFids *af
                if ( conns[i] != connSuccess )
                        rx_DestroyConnection(conns[i] );
 
+       free(addr);
+       free(conns);
+
        if ( connSuccess ) return 0;    /* success */
                else return 1;          /* failure */
 }
@@ -1782,9 +1789,9 @@ int MultiBreakCallBackAlternateAddress_r(struct host *host, struct AFSCBFids *af
 int MultiProbeAlternateAddress_r(struct host *host)
 {
        int i,j;
-       struct rx_connection*   conns[AFS_MAX_INTERFACE_ADDR];
+       struct rx_connection**  conns;
        struct rx_connection*   connSuccess = 0;
-       afs_int32                       addr[AFS_MAX_INTERFACE_ADDR];
+       afs_int32               *addr;
        static struct rx_securityClass *sc = 0;
        char hoststr[16];
 
@@ -1801,6 +1808,10 @@ int MultiProbeAlternateAddress_r(struct host *host)
        if ( !sc )
            sc = rxnull_NewClientSecurityObject();
 
+       i = host->interface->numberOfInterfaces;
+       addr = malloc(i * sizeof(afs_int32));
+       conns = malloc(i * sizeof(struct rx_connection *));
+
        /* initialize alternate rx connections */
        for ( i=0,j=0; i < host->interface->numberOfInterfaces; i++)
        {
@@ -1847,6 +1858,9 @@ int MultiProbeAlternateAddress_r(struct host *host)
                if ( conns[i] != connSuccess )
                        rx_DestroyConnection(conns[i] );
 
+       free(addr);
+       free(conns);
+
        if ( connSuccess ) return 0;    /* success */
                else return 1;          /* failure */
 }

diff --git a/src/viced/host.c b/src/viced/host.c
index 5edd3cf159e24729b904080d9178d2fd6fa3a632..d41e2fcda6c247f119884c49c713b98bfb2227ec 100644 (file)
--- a/src/viced/host.c
+++ b/src/viced/host.c
@@ -909,7 +909,6 @@ struct host *h_GetHost_r(struct rx_connection *tcon)
     int held;
     struct interfaceAddr interf;
     int interfValid = 0;
-    afs_int32  buffer[AFS_MAX_INTERFACE_ADDR];
     struct Identity *identP = NULL;
     afs_int32 haddr;
     afs_int32 hport;
@@ -1850,7 +1849,6 @@ static struct AFSFid zerofid;
 int CheckHost(register struct host *host, int held)
 {
     register struct client *client;
-    struct interfaceAddr interf;
     int code;
 
     /* Host is held by h_Enumerate */
@@ -1983,11 +1981,11 @@ initInterfaceAddr_r(struct host *host, struct interfaceAddr *interf)
                host->host, interf->numberOfInterfaces));
 
        number = interf->numberOfInterfaces;
-       myPort   = host->port;
-       myHost   = host->host; /* current interface address */
+       myPort = host->port;
+       myHost = host->host; /* current interface address */
 
        /* validation checks */
-       if ( number < 0 )
+       if ( number < 0 || number > AFS_MAX_INTERFACE_ADDR )
         {
                ViceLog(0,("Number of alternate addresses returned is %d\n",
                         number));