From: Benjamin Kaduk <kaduk@mit.edu>
Date: Sat, 2 Feb 2019 20:23:03 +0000 (-0600)
Subject: vlserver: fix vlentryread() for old vldb formats
X-Git-Tag: upstream/1.8.6_pre1^2~44
X-Git-Url: https://git.michaelhowe.org/gitweb/?a=commitdiff_plain;h=c83a135dac77b916d1188026a12634de0e98fc3a;p=packages%2Fo%2Fopenafs.git

vlserver: fix vlentryread() for old vldb formats

When we're using old format compatibility, use OMAXNSERVERS for the
array lengths instead of MAXNSERVERS.  Otherwise we'll try to copy more
data than we've read.

Detected by gcc8 as:

vlutils.c:183:2: error: ‘memcpy’ forming offset [149, 151] is out of the bounds [0, 148] of object ‘tentry’ with type ‘struct vlentry’ [-Werror=array-bounds]
  memcpy(nbufp->serverFlags, oep->serverFlags, NMAXNSERVERS);
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
vlutils.c:141:26: note: ‘tentry’ declared here
     struct vlentry *oep, tentry;
                          ^~~~~~

Reviewed-on: https://gerrit.openafs.org/13465
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Cheyenne Wills <cwills@sinenomine.net>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
(cherry picked from commit 7620bd33487207b348ed7aeba45f8d743132ba84)

Change-Id: I7dc4ad48805c6a82dd021d156fe187dd97e5b456
Reviewed-on: https://gerrit.openafs.org/13734
Reviewed-by: Andrew Deason <adeason@sinenomine.net>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Stephan Wiesand <stephan.wiesand@desy.de>
---

diff --git a/src/vlserver/vlutils.c b/src/vlserver/vlutils.c
index 06ad04b67..d61588419 100644
--- a/src/vlserver/vlutils.c
+++ b/src/vlserver/vlutils.c
@@ -178,9 +178,9 @@ vlentryread(struct ubik_trans *trans, afs_int32 offset, char *buffer,
 	    nbufp->nextIdHash[i] = ntohl(oep->nextIdHash[i]);
 	nbufp->nextNameHash = ntohl(oep->nextNameHash);
 	memcpy(nbufp->name, oep->name, VL_MAXNAMELEN);
-	memcpy(nbufp->serverNumber, oep->serverNumber, NMAXNSERVERS);
-	memcpy(nbufp->serverPartition, oep->serverPartition, NMAXNSERVERS);
-	memcpy(nbufp->serverFlags, oep->serverFlags, NMAXNSERVERS);
+	memcpy(nbufp->serverNumber, oep->serverNumber, OMAXNSERVERS);
+	memcpy(nbufp->serverPartition, oep->serverPartition, OMAXNSERVERS);
+	memcpy(nbufp->serverFlags, oep->serverFlags, OMAXNSERVERS);
     }
     return 0;
 }