From: Nickolai Zeldovich <kolya@mit.edu>
Date: Thu, 14 Nov 2002 21:56:57 +0000 (+0000)
Subject: Allocate memory for the interface addr arrays dynamically
X-Git-Tag: openafs-stable-1_2_8~39
X-Git-Url: https://git.michaelhowe.org/gitweb/?a=commitdiff_plain;h=ae6bcfab00c204a4fbf12527f6d4a5045f1288df;p=packages%2Fo%2Fopenafs.git

Allocate memory for the interface addr arrays dynamically
to avoid potential overruns.


(cherry picked from commit f349e5b3fa0206cd6269df256911a73f52ff4a0b)
---

diff --git a/src/viced/callback.c b/src/viced/callback.c
index a10b2cdd3..219a3141b 100644
--- a/src/viced/callback.c
+++ b/src/viced/callback.c
@@ -1791,9 +1791,9 @@ struct host*		host;
 struct AFSCBFids*	afidp;
 {
 	int i,j;
-	struct rx_connection*	conns[AFS_MAX_INTERFACE_ADDR];
+	struct rx_connection**	conns;
 	struct rx_connection*   connSuccess = 0;
-	afs_int32			addr[AFS_MAX_INTERFACE_ADDR];
+	afs_int32		*addr;
 	static struct rx_securityClass *sc = 0;
 	static struct AFSCBs tc = {0,0};
 
@@ -1810,6 +1810,10 @@ struct AFSCBFids*	afidp;
 	if ( !sc )
 	    sc = (struct rx_securityClass *) rxnull_NewClientSecurityObject();
 
+	i = host->interface->numberOfInterfaces;
+	addr = malloc(i * sizeof(afs_int32));
+	conns = malloc(i * sizeof(struct rx_connection *));
+
 	/* initialize alternate rx connections */
 	for ( i=0,j=0; i < host->interface->numberOfInterfaces; i++)
 	{
@@ -1856,6 +1860,9 @@ struct AFSCBFids*	afidp;
 		if ( conns[i] != connSuccess )
 			rx_DestroyConnection(conns[i] );
 
+	free(addr);
+	free(conns);
+
 	if ( connSuccess ) return 0;	/* success */
 		else return 1;		/* failure */
 }
@@ -1870,9 +1877,9 @@ MultiProbeAlternateAddress_r(host)
 struct host*		host;
 {
 	int i,j;
-	struct rx_connection*	conns[AFS_MAX_INTERFACE_ADDR];
+	struct rx_connection**	conns;
 	struct rx_connection*   connSuccess = 0;
-	afs_int32			addr[AFS_MAX_INTERFACE_ADDR];
+	afs_int32		*addr;
 	static struct rx_securityClass *sc = 0;
 
 	/* nothing more can be done */
@@ -1888,6 +1895,10 @@ struct host*		host;
 	if ( !sc )
 	    sc = (struct rx_securityClass *) rxnull_NewClientSecurityObject();
 
+	i = host->interface->numberOfInterfaces;
+	addr = malloc(i * sizeof(afs_int32));
+	conns = malloc(i * sizeof(struct rx_connection *));
+
 	/* initialize alternate rx connections */
 	for ( i=0,j=0; i < host->interface->numberOfInterfaces; i++)
 	{
@@ -1934,6 +1945,9 @@ struct host*		host;
 		if ( conns[i] != connSuccess )
 			rx_DestroyConnection(conns[i] );
 
+	free(addr);
+	free(cons);
+
 	if ( connSuccess ) return 0;	/* success */
 		else return 1;		/* failure */
 }
diff --git a/src/viced/host.c b/src/viced/host.c
index 14c9e6d39..226a79461 100644
--- a/src/viced/host.c
+++ b/src/viced/host.c
@@ -956,7 +956,6 @@ struct host *h_GetHost_r(tcon)
     int held;
     struct interfaceAddr interf;
     int interfValid = 0;
-    afs_int32	buffer[AFS_MAX_INTERFACE_ADDR];
     struct Identity *identP = NULL;
     afs_int32 haddr;
     afs_int32 hport;
@@ -1934,7 +1933,6 @@ int CheckHost(host, held)
 
 {
     register struct client *client;
-    struct interfaceAddr interf;
     int code;
 
     /* Host is held by h_Enumerate */
@@ -2070,11 +2068,11 @@ struct interfaceAddr *interf;
 		host->host, interf->numberOfInterfaces));
 
 	number = interf->numberOfInterfaces;
-	myPort   = host->port;
-	myHost   = host->host; /* current interface address */
+	myPort = host->port;
+	myHost = host->host; /* current interface address */
 
 	/* validation checks */
-	if ( number < 0 )
+	if ( number < 0 || number > AFS_MAX_INTERFACE_ADDR )
         {
 		ViceLog(0,("Number of alternate addresses returned is %d\n",
 			 number));