I recently realized that, after upgrading from 2.1.3 to 2.1.14,
cfexecd on Solaris7 stopped working. The symptoms were syslog msgs
like so:
Jun 16 07:00:45 jasmine cfexecd[2151]: cfengine defines no system
administrator address
Jun 16 07:00:45 jasmine cfexecd[2151]: Need: sysadm = ( [EMAIL PROTECTED] )
in control
Running from the command line, gethostbyname() was failing to send
the following, unexpected output:
cfexecd: Couldn't run /var/cfengine/bin/cfagent -q -Dfrom_cfexecd
cfexecd: execv: Bad file number
About five contexts deep into debugging, I found a buffer overwrite,
which in turn was causing gethostbyname() and sscanf() to fail.
The former is used by cfexecd to send mail, and the latter is used
in SplitCommand() to setup an argv for the execv() in cfpopen().
Patch for 2.1.15 is attached.
Mark: if you'd me to explain futher, just holler. But I think it's
reasonable to assume that strncpy'ing 4096 (CF_BUFSIZE) bytes into 18
(VIPADDRESS) bytes is not a good thing!
steve
- - -
systems & network manager
high energy physics
university of wisconsin
*** cfexecd.c.orig Wed May 25 02:52:26 2005
--- cfexecd.c Thu Jun 16 11:40:24 2005
***************
*** 452,458 ****
if (strcmp(name,"ipaddress") == 0)
{
Debug("%s/%s\n",name,content);
! strncpy(VIPADDRESS,content,CF_MAXVARSIZE-1);
continue;
}
--- 452,458 ----
if (strcmp(name,"ipaddress") == 0)
{
Debug("%s/%s\n",name,content);
! strncpy(VIPADDRESS,content,sizeof(VIPADDRESS));
continue;
}
_______________________________________________
Bug-cfengine mailing list
[email protected]
http://lists.gnu.org/mailman/listinfo/bug-cfengine
