From e89f90f7f17efc80c984b2858cd85a87f8cdfbf3 Mon Sep 17 00:00:00 2001
From: "simon@sxw.org.uk" <simon@sxw.org.uk>
Date: Tue, 2 Jun 2009 04:32:08 +0000
Subject: [PATCH] auth-cellconfig-overflow-20090601

LICENSE IPL10
FIXES 124891
---
 src/auth/cellconfig.c | 54 +++++++++++++++++++++++++------------------
 1 file changed, 32 insertions(+), 22 deletions(-)

diff --git a/src/auth/cellconfig.c b/src/auth/cellconfig.c
index 2af281d40..1dc4a517e 100644
--- a/src/auth/cellconfig.c
+++ b/src/auth/cellconfig.c
@@ -720,31 +720,41 @@ afsconf_OpenInternal(register struct afsconf_dir *adir, char *cell,
 		return -1;
 	    }
 	    i = curEntry->cellInfo.numServers;
-	    if (cell && !strcmp(cell, curEntry->cellInfo.name))
-		code =
-		    ParseHostLine(tbuffer, &curEntry->cellInfo.hostAddr[i],
-				  curEntry->cellInfo.hostName[i], &clones[i]);
-	    else
-		code =
-		    ParseHostLine(tbuffer, &curEntry->cellInfo.hostAddr[i],
-				  curEntry->cellInfo.hostName[i], 0);
-	    if (code) {
-		if (code == AFSCONF_SYNTAX) {
-		    for (bp = tbuffer; *bp != '\n'; bp++) {	/* Take out the <cr> from the buffer */
-			if (!*bp)
-			    break;
+	    if (i < MAXHOSTSPERCELL) {
+		if (cell && !strcmp(cell, curEntry->cellInfo.name))
+		    code =
+			ParseHostLine(tbuffer, 
+				      &curEntry->cellInfo.hostAddr[i],
+				      curEntry->cellInfo.hostName[i], 
+				      &clones[i]);
+		else
+		    code =
+			ParseHostLine(tbuffer, 
+				      &curEntry->cellInfo.hostAddr[i],
+				      curEntry->cellInfo.hostName[i], 0);
+
+		if (code) {
+		    if (code == AFSCONF_SYNTAX) {
+			for (bp = tbuffer; *bp != '\n'; bp++) {	/* Take out the <cr> from the buffer */
+			    if (!*bp)
+				break;
+			}
+			*bp = '\0';
+			fprintf(stderr,
+				"Can't properly parse host line \"%s\" in configuration file %s\n",
+				tbuffer, tbuf1);
 		    }
-		    *bp = '\0';
-		    fprintf(stderr,
-			    "Can't properly parse host line \"%s\" in configuration file %s\n",
-			    tbuffer, tbuf1);
+		    free(curEntry);
+		    fclose(tf);
+		    afsconf_CloseInternal(adir);
+		    return -1;
 		}
-		free(curEntry);
-		fclose(tf);
-		afsconf_CloseInternal(adir);
-		return -1;
+		curEntry->cellInfo.numServers = ++i;
+	    } else {
+		fprintf(stderr,
+			"Too many hosts for cell %s in configuration file %s\n", 
+			curEntry->cellInfo.name, tbuf1);
 	    }
-	    curEntry->cellInfo.numServers = ++i;
 	}
     }
     fclose(tf);			/* close the file now */
-- 
2.39.5