mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-21 11:13:30 +00:00
Code Issues Releases Activity

Add MAX_LUNS overflow safety checks.

Browse Source 
While this MAX_LUNS limitation is too synthetic and should be removed,
it is better to enforce it while it is here.

MFC after:	2 weeks
This commit is contained in:
Alexander Motin 2016-12-27 17:13:31 +00:00
parent 7502cc401b
commit dad99db247
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=310633
2 changed files with 27 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
usr.sbin/ctld/parse.y
View File

@ -821,6 +821,11 @@ lun_number: STR
free($1);
return (1);
}
if (tmp >= MAX_LUNS) {
yyerror("LU number is too big");
free($1);
return (1);
}
ret = asprintf(&name, "%s,lun,%ju", target->t_name, tmp);
if (ret <= 0)
@ -845,6 +850,11 @@ target_lun_ref: LUN STR STR
return (1);
}
free($2);
if (tmp >= MAX_LUNS) {
yyerror("LU number is too big");
free($3);
return (1);
}
lun = lun_find(conf, $3);
free($3);

21
usr.sbin/ctld/uclparse.c
View File

@ -183,18 +183,25 @@ static int
uclparse_target_lun(struct target *target, const ucl_object_t *obj)
{
struct lun *lun;
uint64_t tmp;
if (obj->type == UCL_INT) {
char *name;
asprintf(&name, "%s,lun,%ju", target->t_name,
ucl_object_toint(obj));
tmp = ucl_object_toint(obj);
if (tmp >= MAX_LUNS) {
log_warnx("LU number %ju in target \"%s\" is too big",
tmp, target->t_name);
return (1);
}
asprintf(&name, "%s,lun,%ju", target->t_name, tmp);
lun = lun_new(conf, name);
if (lun == NULL)
return (1);
lun_set_scsiname(lun, name);
target->t_luns[ucl_object_toint(obj)] = lun;
target->t_luns[tmp] = lun;
return (0);
}
@ -207,6 +214,12 @@ uclparse_target_lun(struct target *target, const ucl_object_t *obj)
"\"number\" integer property", target->t_name);
return (1);
}
tmp = ucl_object_toint(num);
if (tmp >= MAX_LUNS) {
log_warnx("LU number %ju in target \"%s\" is too big",
tmp, target->t_name);
return (1);
}
if (name == NULL || name->type != UCL_STRING) {
log_warnx("lun section in target \"%s\" is missing "
@ -218,7 +231,7 @@ uclparse_target_lun(struct target *target, const ucl_object_t *obj)
if (lun == NULL)
return (1);
target->t_luns[ucl_object_toint(num)] = lun;
target->t_luns[tmp] = lun;
}
return (0);