[Cluster-devel] [PATCH 29/41] qdiskd: add strlen check to avoid memory corruption

[Fabio M. Di Nitto]

and fix a few impossible buffer overflows

Spotted by Coverity Scan

Signed-off-by: Fabio M. Di Nitto <fdini...@redhat.com>
---
:100644 100644 d5926f9... 929b152... M  cman/qdisk/daemon_init.c
 cman/qdisk/daemon_init.c |   14 +++++++++-----
 1 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/cman/qdisk/daemon_init.c b/cman/qdisk/daemon_init.c
index d5926f9..929b152 100644
--- a/cman/qdisk/daemon_init.c
+++ b/cman/qdisk/daemon_init.c
@@ -48,11 +48,12 @@ check_pid_valid(pid_t pid, char *prog)
        char dirpath[PATH_MAX];
        char proc_cmdline[64];  /* yank this from kernel somewhere */
        char *s = NULL;
+       size_t proc_cmdline_len = 0;
 
        memset(filename, 0, PATH_MAX);
        memset(dirpath, 0, PATH_MAX);
 
-       snprintf(dirpath, sizeof (dirpath), "/proc/%d", pid);
+       snprintf(dirpath, sizeof (dirpath) - 1, "/proc/%d", pid);
        if ((dir = opendir(dirpath)) == NULL) {
                closedir(dir);
                return 0;       /* Pid has gone away. */
@@ -63,7 +64,7 @@ check_pid_valid(pid_t pid, char *prog)
         * proc-pid directory exists.  Now check to see if this
         * PID corresponds to the daemon we want to start.
         */
-       snprintf(filename, sizeof (filename), "/proc/%d/cmdline", pid);
+       snprintf(filename, sizeof (filename) - 1, "/proc/%d/cmdline", pid);
        fp = fopen(filename, "r");
        if (fp == NULL) {
                perror("check_pid_valid");
@@ -83,9 +84,12 @@ check_pid_valid(pid_t pid, char *prog)
        }
        fclose(fp);
 
-       s = &(proc_cmdline[strlen(proc_cmdline)]);
-       if (*s == '\n')
-               *s = 0;
+       proc_cmdline_len = strlen(proc_cmdline);
+       if (proc_cmdline_len) {
+               s = &(proc_cmdline[proc_cmdline_len]);
+               if (*s == '\n')
+                       *s = 0;
+       }
 
        /*
         * Check to see if this is the same executable.
-- 
1.7.4.4