From owner-svn-src-stable-11@freebsd.org Tue Jan 10 08:23:07 2017 Return-Path: Delivered-To: svn-src-stable-11@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id D7422CA9D13; Tue, 10 Jan 2017 08:23:07 +0000 (UTC) (envelope-from mav@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 8D90B1D94; Tue, 10 Jan 2017 08:23:07 +0000 (UTC) (envelope-from mav@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v0A8N6dH067023; Tue, 10 Jan 2017 08:23:06 GMT (envelope-from mav@FreeBSD.org) Received: (from mav@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v0A8N6u3067021; Tue, 10 Jan 2017 08:23:06 GMT (envelope-from mav@FreeBSD.org) Message-Id: <201701100823.v0A8N6u3067021@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: mav set sender to mav@FreeBSD.org using -f From: Alexander Motin Date: Tue, 10 Jan 2017 08:23:06 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org Subject: svn commit: r311865 - stable/11/usr.sbin/ctld X-SVN-Group: stable-11 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable-11@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for only the 11-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Jan 2017 08:23:08 -0000 Author: mav Date: Tue Jan 10 08:23:06 2017 New Revision: 311865 URL: https://svnweb.freebsd.org/changeset/base/311865 Log: MFC r310633: Add MAX_LUNS overflow safety checks. While this MAX_LUNS limitation is too synthetic and should be removed, it is better to enforce it while it is here. Modified: stable/11/usr.sbin/ctld/parse.y stable/11/usr.sbin/ctld/uclparse.c Directory Properties: stable/11/ (props changed) Modified: stable/11/usr.sbin/ctld/parse.y ============================================================================== --- stable/11/usr.sbin/ctld/parse.y Tue Jan 10 08:12:56 2017 (r311864) +++ stable/11/usr.sbin/ctld/parse.y Tue Jan 10 08:23:06 2017 (r311865) @@ -821,6 +821,11 @@ lun_number: STR free($1); return (1); } + if (tmp >= MAX_LUNS) { + yyerror("LU number is too big"); + free($1); + return (1); + } ret = asprintf(&name, "%s,lun,%ju", target->t_name, tmp); if (ret <= 0) @@ -845,6 +850,11 @@ target_lun_ref: LUN STR STR return (1); } free($2); + if (tmp >= MAX_LUNS) { + yyerror("LU number is too big"); + free($3); + return (1); + } lun = lun_find(conf, $3); free($3); Modified: stable/11/usr.sbin/ctld/uclparse.c ============================================================================== --- stable/11/usr.sbin/ctld/uclparse.c Tue Jan 10 08:12:56 2017 (r311864) +++ stable/11/usr.sbin/ctld/uclparse.c Tue Jan 10 08:23:06 2017 (r311865) @@ -183,18 +183,25 @@ static int uclparse_target_lun(struct target *target, const ucl_object_t *obj) { struct lun *lun; + uint64_t tmp; if (obj->type == UCL_INT) { char *name; - asprintf(&name, "%s,lun,%ju", target->t_name, - ucl_object_toint(obj)); + tmp = ucl_object_toint(obj); + if (tmp >= MAX_LUNS) { + log_warnx("LU number %ju in target \"%s\" is too big", + tmp, target->t_name); + return (1); + } + + asprintf(&name, "%s,lun,%ju", target->t_name, tmp); lun = lun_new(conf, name); if (lun == NULL) return (1); lun_set_scsiname(lun, name); - target->t_luns[ucl_object_toint(obj)] = lun; + target->t_luns[tmp] = lun; return (0); } @@ -207,6 +214,12 @@ uclparse_target_lun(struct target *targe "\"number\" integer property", target->t_name); return (1); } + tmp = ucl_object_toint(num); + if (tmp >= MAX_LUNS) { + log_warnx("LU number %ju in target \"%s\" is too big", + tmp, target->t_name); + return (1); + } if (name == NULL || name->type != UCL_STRING) { log_warnx("lun section in target \"%s\" is missing " @@ -218,7 +231,7 @@ uclparse_target_lun(struct target *targe if (lun == NULL) return (1); - target->t_luns[ucl_object_toint(num)] = lun; + target->t_luns[tmp] = lun; } return (0);