Avoid sprintf buffer overrun if huge hostname

[openldap] / servers / slurpd / st.c

diff --git a/servers/slurpd/st.c b/servers/slurpd/st.c
index cb78c2d9c90b4a7d3cce6d8d687c242995befab7..d355ce68a554e0f1f8bafd994a29f8b8ed446e40 100644 (file)
--- a/servers/slurpd/st.c
+++ b/servers/slurpd/st.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2005 The OpenLDAP Foundation.
+ * Copyright 1998-2006 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -43,6 +43,7 @@
 
 #include "slurp.h"
 #include "globals.h"
+#include "lutil.h"
 
 /*
  * Add information about replica host specified by Ri to list
@@ -230,20 +231,25 @@ St_read(
 
        found = 0;
        for ( i = 0; i < sglob->st->st_nreplicas; i++ ) {
+           int p;
            if ( !strcmp( hostname, sglob->st->st_data[ i ]->hostname ) &&
-                   atoi( port ) == sglob->st->st_data[ i ]->port ) {
+                   lutil_atoi( &p, port ) == 0 && p == sglob->st->st_data[ i ]->port )
+           {
                found = 1;
-               sglob->st->st_data[ i ]->last = atol( timestamp );
-               sglob->st->st_data[ i ]->seq = atoi( seq );
+               if ( lutil_atol( &sglob->st->st_data[ i ]->last, timestamp ) != 0
+                       || lutil_atoi( &sglob->st->st_data[ i ]->seq, seq ) != 0 )
+               {
+                   found = 0;
+               }
                break;
            }
        }
        if ( found ) {
            char tbuf[ 255 ];
-           sprintf( tbuf, "%s:%s (timestamp %s.%s)", hostname, port,
-                   timestamp, seq );
+           sprintf( tbuf, "%s.%s", timestamp, seq );
            Debug( LDAP_DEBUG_ARGS,
-                   "Retrieved state information for %s\n", tbuf, 0, 0 );
+                   "Retrieved state information for %s:%s (timestamp %s)\n",
+                       hostname, port, tbuf );
        } else {
            Debug(  LDAP_DEBUG_ANY,
                    "Warning: saved state for %s:%s, not a known replica\n",