Changeset 2700 in MondoRescue

Timestamp:

Jan 27, 2011, 7:31:06 PM (13 years ago)

Author:

Bruno Cornec

Message:

r4176@localhost: bruno | 2011-01-26 18:11:02 +0100

• Fix buffer overflow with long exclude lines where log between mindi and mondo were exceeding fixed string size used

Location:

branches/2.2.9

Files:

• mindi/analyze-my-lvm (modified) (1 diff)
• mindi/mindi-bkphw (modified) (2 diffs)
• mondo/src/common/libmondo-fork.c (modified) (4 diffs)
• mondo/src/common/newt-specific.c (modified) (5 diffs)

branches/2.2.9/mindi/analyze-my-lvm

@@ -142 +142 @@
         list_of_devices=""
         for i in $physical_volumes ; do
-            fname=/proc/lvm/VGs/$current_VG/PVs/$i
-            device=`GetValueFromField $fname "name:"`
-            list_of_devices="$list_of_devices $device"
+            fname=/proc/lvm/VGs/$current_VG/PVs/$i
+            device=`GetValueFromField $fname "name:"`
+            list_of_devices="$list_of_devices $device"
         done
         current_PVs=$list_of_devices

branches/2.2.9/mindi/mindi-bkphw

@@ -54 +54 @@
         chomp($tool);
         $tooldir = dirname($tool);
-        if (! (-e $tool)) {
+        if (! (-x $tool)) {
             print "You should install the SmartStart Scripting toolkit tool $tool\nto benefit from mindi's enhanced hardware support\n";
             print "Get it from http://www.hp.com/servers/sstoolkit\n";
@@ -73 +73 @@
             print TOOLS "$tooldir/bld\n";
         }
-        if ($tool =~ /\/.hpacucli$/) {
+        if ($tool =~ /\/hpacucli$/) {
             my $dir=basename($tool);
             $ret = system("export ACUXE_BIN_INSTALLATION_DIR=$dir ; export IM_CFGFILE_PATH=$dir ; export ACUXE_LOCK_FILES_DIR=$dir/locks ; $tool -c $bkpdir/hpacucli.dat");

branches/2.2.9/mondo/src/common/libmondo-fork.c

@@ -379 +379 @@
 
     /*@ buffers **************************************************** */
-    char tmp[MAX_STR_LEN * 2];
-    char command[MAX_STR_LEN * 2];
+    char *tmp = NULL;
+    char *command = NULL;
     char lockfile[MAX_STR_LEN];
 
@@ -389 +389 @@
     sprintf(lockfile, "%s/mojo-jojo.bla.bla", bkpinfo->tmpdir);
 
-    sprintf(command,
+    mr_asprintf(&command,
             "echo hi > %s ; %s >> %s 2>> %s; res=$?; sleep 1; rm -f %s; exit $res",
             lockfile, basic_call, MONDO_LOGFILE, MONDO_LOGFILE, lockfile);
     open_evalcall_form(what_i_am_doing);
-    sprintf(tmp, "Executing %s", basic_call);
+    mr_asprintf(&tmp, "Executing %s", basic_call);
     log_msg(2, tmp);
+    mr_free(tmp);
+
     if (!(fin = popen(command, "r"))) {
         log_OS_error("Unable to popen-in command");
-        sprintf(tmp, "Failed utterly to call '%s'", command);
+        mr_asprintf(&tmp, "Failed utterly to call '%s'", command);
         log_to_screen(tmp);
+        mr_free(tmp);
+        mr_free(command);
         return (1);
     }
@@ -407 +411 @@
         }
     }
+    mr_free(command);
 #ifdef _XWIN
     /* This only can update when newline goes into the file,
@@ -412 +417 @@
     while (does_file_exist(lockfile)) {
         while (!feof(fin)) {
+            /* TODO: Dead and wrong code */
             if (!fgets(tmp, 512, fin))
                 break;

branches/2.2.9/mondo/src/common/newt-specific.c

@@ -471 +471 @@
 
         /*@ buffers ********************************************************** */
-        char *command;
-        char *tmp;
+        char *command = NULL;
+        char *tmp = NULL;
 
         /*@ pointers ********************************************************* */
@@ -480 +480 @@
         int i = 0;
 
-        malloc_string(command);
-        malloc_string(tmp);
         assert_string_is_neither_NULL_nor_zerolength(filename);
         assert(grep_for_me != NULL);
 
         if (!does_file_exist(filename)) {
-            paranoid_free(command);
-            paranoid_free(tmp);
             return;
         }
         if (grep_for_me[0] != '\0') {
-            sprintf(command, "grep '%s' %s | tail -n%d",
+            mr_asprintf(&command, "grep '%s' %s | tail -n%d",
                     grep_for_me, filename, g_noof_log_lines);
         } else {
-            sprintf(command, "tail -n%d %s", g_noof_log_lines,
+            mr_asprintf(&command, "tail -n%d %s", g_noof_log_lines,
                     filename);
         }
@@ -510 +506 @@
                     */
                     if (!strncmp(err_log_lines[i], "root:", 5)) {
-                        strcpy(tmp, err_log_lines[i] + 6);
-                        strcpy(err_log_lines[i], tmp);
+                        mr_asprintf(&tmp, "%s", err_log_lines[i] + 6);
+                        strncpy(err_log_lines[i], tmp, (size_t)MAX_NEWT_COMMENT_LEN);
+                        mr_free(tmp);
                     }
                     if (feof(fin)) {
@@ -520 +517 @@
             paranoid_pclose(fin);
         }
+        mr_free(command);
         refresh_log_screen();
-        paranoid_free(command);
-        paranoid_free(tmp);
     }
 
@@ -545 +541 @@
 
         va_start(args, fmt);
-        vsprintf(output, fmt, args);
+        vsnprintf(output, MAX_STR_LEN-1, fmt, args);
         log_msg(0, output);
         output[80] = '\0';