Skip to content

Commit 90220ca

Browse files
committed
Fixed length checking in StatFile
If a symlink resolves to a path that is longer than the maximum allowed by the protocol, currently 4088 bytes, then an error response is generated. Previously the server side would ignore an error from SendTransaction() due to the large size and the client-side would hang/timeout waiting for a response. Ticket: ENT-13542 Changelog: title
1 parent 44bb0c4 commit 90220ca

File tree

1 file changed

+10
-2
lines changed

1 file changed

+10
-2
lines changed

cf-serverd/server_common.c

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -732,6 +732,7 @@ int StatFile(ServerConnectionState *conn, char *sendbuffer, char *ofilename)
732732
/* the simplest way to transfer the data is to convert them into */
733733
/* plain text and interpret them on the other side. */
734734
{
735+
assert(conn != NULL);
735736
Stat cfst;
736737
struct stat statbuf, statlinkbuf;
737738
char linkbuf[CF_BUFSIZE], filename[CF_BUFSIZE - 128];
@@ -874,10 +875,17 @@ int StatFile(ServerConnectionState *conn, char *sendbuffer, char *ofilename)
874875

875876
memset(sendbuffer, 0, CF_MSGSIZE);
876877

878+
// +3 because we need to prepend 'OK:' to the path
879+
if (strlen(linkbuf)+3 > CF_MSGSIZE) {
880+
NDEBUG_UNUSED int ret = snprintf(sendbuffer, CF_MSGSIZE, "BAD: Symlink resolves to a path too long (%ld) to send over the protocol.", strlen(linkbuf)+3);
881+
assert(ret > 0 && ret < CF_MSGSIZE);
882+
SendTransaction(conn->conn_info, sendbuffer, 0, CF_DONE);
883+
return -1;
884+
}
877885
if (cfst.cf_readlink != NULL)
878886
{
879-
strcpy(sendbuffer, "OK:");
880-
strcat(sendbuffer, cfst.cf_readlink);
887+
NDEBUG_UNUSED int ret = snprintf(sendbuffer, CF_MSGSIZE, "OK:%s", linkbuf);
888+
assert(ret > 0 && ret < CF_MSGSIZE);
881889
}
882890
else
883891
{

0 commit comments

Comments
 (0)