diff mbox series

[ibsim,22/23] sim_cmd.c: Fix out of bound memory access in do_cmd

Message ID 20190102131318.5765-22-honli@redhat.com (mailing list archive)
State Not Applicable
Headers show
Series [ibsim,01/23] move sim_cmd_file into ibsim/sim_cmd.c | expand

Commit Message

Honggang LI Jan. 2, 2019, 1:13 p.m. UTC 
==6662== 287 errors in context 1 of 1:
==6662== Use of uninitialised value of size 8
==6662==    at 0x4108EA: do_cmd (sim_cmd.c:1199)
==6662==    by 0x412976: sim_run_console (ibsim.c:563)
==6662==    by 0x412D24: sim_run (ibsim.c:604)
==6662==    by 0x41352E: main (ibsim.c:783)
==6662==  Uninitialised value was created by a stack allocation
==6662==    at 0x4128EF: sim_run_console (ibsim.c:552)

Signed-off-by: Honggang Li <honli@redhat.com>
---
 ibsim/sim_cmd.c | 59 ++++++++++++++++++++++++++++++++-------------------------
 1 file changed, 33 insertions(+), 26 deletions(-)

Comments

Hal Rosenstock Jan. 11, 2019, 2:13 p.m. UTC | #1 
On 1/2/2019 8:13 AM, Honggang Li wrote:
> ==6662== 287 errors in context 1 of 1:
> ==6662== Use of uninitialised value of size 8
> ==6662==    at 0x4108EA: do_cmd (sim_cmd.c:1199)
> ==6662==    by 0x412976: sim_run_console (ibsim.c:563)
> ==6662==    by 0x412D24: sim_run (ibsim.c:604)
> ==6662==    by 0x41352E: main (ibsim.c:783)
> ==6662==  Uninitialised value was created by a stack allocation
> ==6662==    at 0x4128EF: sim_run_console (ibsim.c:552)
> 
> Signed-off-by: Honggang Li <honli@redhat.com>

Thanks. Applied.

-- Hal
diff mbox series

Patch

diff --git a/ibsim/sim_cmd.c b/ibsim/sim_cmd.c
index 325292103caa..fe3e3067882d 100644
--- a/ibsim/sim_cmd.c
+++ b/ibsim/sim_cmd.c
@@ -1188,69 +1188,76 @@  int sim_cmd_file(FILE * f, char *s)
 
 int netstarted;
 
+static int match_command(char * line, char *cmd, unsigned int cmd_len)
+{
+	if (cmd_len != strlen(cmd))
+		return 0;
+	return !(strncasecmp(line, cmd, strlen(cmd)));
+}
+
 int do_cmd(char *buf, FILE *f)
 {
 	unsigned int cmd_len = 0;
 	char *line;
 	int r = 0;
+	unsigned int max_cmd_len, i;
 
 	for (line = buf; *line && isspace(*line); line++) ;
 
-	while (!isspace(line[cmd_len]))
-		cmd_len++;
+	max_cmd_len = strlen(line);
+	for (i=0; i<max_cmd_len; i++) {
+		if (!isspace(line[cmd_len]))
+			cmd_len++;
+		else
+			break;
+	}
 
 	if (*line == '#')
 		fprintf(f, "%s", line);
 	else if (*line == '!')
 		r = sim_cmd_file(f, line);
-	else if (!strncasecmp(line, "Dump", cmd_len))
+	else if (match_command(line, "Dump", cmd_len))
 		r = dump_net(f, line);
-	else if (!strncasecmp(line, "Route", cmd_len))
+	else if (match_command(line, "Route", cmd_len))
 		r = dump_route(f, line);
-	else if (!strncasecmp(line, "Link", cmd_len))
+	else if (match_command(line, "Link", cmd_len))
 		r = do_link(f, line);
-	else if (!strncasecmp(line, "Unlink", cmd_len))
+	else if (match_command(line, "Unlink", cmd_len))
 		r = do_unlink(f, line, 0);
-	else if (!strncasecmp(line, "Clear", cmd_len))
+	else if (match_command(line, "Clear", cmd_len))
 		r = do_unlink(f, line, 1);
-	else if (!strncasecmp(line, "Guid", cmd_len))
+	else if (match_command(line, "Guid", cmd_len))
 		r = do_set_guid(f, line);
-	else if (!strncasecmp(line, "Error", cmd_len))
+	else if (match_command(line, "Error", cmd_len))
 		r = do_seterror(f, line);
-	else if (!strncasecmp(line, "Baselid", cmd_len))
+	else if (match_command(line, "Baselid", cmd_len))
 		r = do_change_baselid(f, line);
-	else if (!strncasecmp(line, "Start", cmd_len)) {
+	else if (match_command(line, "Start", cmd_len)) {
 		if (!netstarted) {
 			DEBUG("starting...");
 			netstarted = 1;
 			return 0;
 		}
 	}
-	else if (!strncasecmp(line, "Verbose", cmd_len))
+	else if (match_command(line, "Verbose", cmd_len))
 		r = change_verbose(f, line);
-	else if (!strncasecmp(line, "Wait", cmd_len))
+	else if (match_command(line, "Wait", cmd_len))
 		r = do_wait(f, line);
-	else if (!strncasecmp(line, "Attached", cmd_len))
+	else if (match_command(line, "Attached", cmd_len))
 		r = list_connections(f);
-	else if (!strncasecmp(line, "X", cmd_len))
+	else if (match_command(line, "X", cmd_len))
 		r = do_disconnect_client(f, strtol(line + 2, 0, 0));
-	else if (!strncasecmp(line, "Help", cmd_len)
-		 || !strncasecmp(line, "?", cmd_len))
+	else if (match_command(line, "Help", cmd_len)
+		 || match_command(line, "?", cmd_len))
 		r = dump_help(f);
-	else if (!strncasecmp(line, "Quit", cmd_len)) {
+	else if (match_command(line, "Quit", cmd_len)) {
 		fprintf(f, "Exiting network simulator.\n");
 		free_core();
 		exit(0);
 	}
-	/* commands specified above support legacy single
-	 * character options.  For example, 'g' or 'G' for "Guid"
-	 * and 'l' or 'L' for "Link".
-	 *
-	 * please specify new command support below this comment.
-	 */
-	else if (!strncasecmp(line, "ReLink", cmd_len))
+	else if (match_command(line, "ReLink", cmd_len))
 		r = do_relink(f, line);
-	else if (!strncasecmp(line, "PerformanceSet", cmd_len))
+	else if (match_command(line, "PerformanceSet", cmd_len))
 		r = do_perf_counter_set(f, line);
 	else if (*line != '\n' && *line != '\0')
 		fprintf(f, "command \'%s\' unknown - skipped\n", line);