This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "Cluster Project".
http://sources.redhat.com/git/gitweb.cgi?p=cluster.git;a=commitdiff;h=256cd80bd60d1194bc5148fb7bd656a0fd8a5a27 The branch, master has been updated via 256cd80bd60d1194bc5148fb7bd656a0fd8a5a27 (commit) from b8920a3ce7c3af2f6d8ff8eed4a739f4b7cb81b6 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 256cd80bd60d1194bc5148fb7bd656a0fd8a5a27 Author: Christine Caulfield <[EMAIL PROTECTED]> Date: Wed Mar 19 11:34:05 2008 +0000 [CMAN] valid port number & don't use it before validation cman_send_data didn't validate the port number. This was not a great problem, but it was slightly silly. cman_start_recv_data used the port number before validation in a debug message, this could crash the server if debug is enabled and a very large port number was passed in. Signed-off-by: Christine Caulfield <[EMAIL PROTECTED]> ----------------------------------------------------------------------- Summary of changes: cman/daemon/commands.c | 2 +- cman/daemon/daemon.c | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletions(-) diff --git a/cman/daemon/commands.c b/cman/daemon/commands.c index eab29fe..5cbc012 100644 --- a/cman/daemon/commands.c +++ b/cman/daemon/commands.c @@ -844,7 +844,7 @@ static int do_cmd_bind(struct connection *con, char *cmdbuf) memcpy(&port, cmdbuf, sizeof(int)); - P_MEMB("requested bind to port %d, port_con = %p (us=%p)\n", port, port_array[port], con); + P_MEMB("requested bind to port %d, (us=%p)\n", port, con); if (port == 0 || port > 255) return -EINVAL; diff --git a/cman/daemon/daemon.c b/cman/daemon/daemon.c index f504db3..11908ad 100644 --- a/cman/daemon/daemon.c +++ b/cman/daemon/daemon.c @@ -272,10 +272,16 @@ static int process_client(poll_handle handle, int fd, int revent, void *data) buf += sizeof(struct sock_data_header); + if (dmsg->port > 255) { + send_status_return(con, msg->command, -EINVAL); + return 0; + } + if (dmsg->port) port = dmsg->port; else port = con->port; + ret = comms_send_message(buf, msg->length - sizeof(struct sock_data_header), port, con->port, dmsg->nodeid, hooks/post-receive -- Cluster Project