Avoid sprintf buffer overrun if huge hostname

[openldap] / servers / slurpd / st.c

diff --git a/servers/slurpd/st.c b/servers/slurpd/st.c
index f0addb7fa672b90499e45ae084d4eddb9960e6eb..d355ce68a554e0f1f8bafd994a29f8b8ed446e40 100644 (file)
--- a/servers/slurpd/st.c
+++ b/servers/slurpd/st.c
@@ -1,6 +1,18 @@
 /* $OpenLDAP$ */
-/*
- * Copyright (c) 1996 Regents of the University of Michigan.
+/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
+ *
+ * Copyright 1998-2006 The OpenLDAP Foundation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted only as authorized by the OpenLDAP
+ * Public License.
+ *
+ * A copy of this license is available in file LICENSE in the
+ * top-level directory of the distribution or, alternatively, at
+ * <http://www.OpenLDAP.org/license.html>.
+ */
+/* Portions Copyright (c) 1996 Regents of the University of Michigan.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms are permitted
@@ -10,6 +22,10 @@
  * software without specific prior written permission. This software
  * is provided ``as is'' without express or implied warranty.
  */
+/* ACKNOWLEDGEMENTS:
+ * This work was originally developed by the University of Michigan
+ * (as part of U-MICH LDAP).
+ */
 
 
 /*
@@ -27,6 +43,7 @@
 
 #include "slurp.h"
 #include "globals.h"
+#include "lutil.h"
 
 /*
  * Add information about replica host specified by Ri to list
@@ -63,7 +80,7 @@ St_add(
 
     st->st_data[ ind ]->hostname = strdup( ri->ri_hostname );
     st->st_data[ ind ]->port = ri->ri_port;
-    memset( st->st_data[ ind ]->last, '\0', sizeof( st->st_data[ ind ]->last )); 
+    st->st_data[ ind ]->last = 0; 
     st->st_data[ ind ]->seq = 0;
 
     ldap_pvt_thread_mutex_unlock( &(st->st_mutex ));
@@ -110,8 +127,9 @@ St_write (
     fseek( st->st_fp, 0L, 0 );
     for ( i = 0; i < st->st_nreplicas; i++ ) {
        stel = st->st_data[ i ];
-       fprintf( st->st_fp, "%s:%d:%s:%d\n", stel->hostname, stel->port,
-               stel->last, stel->seq );
+       fprintf( st->st_fp, "%s:%d:%ld:%d\n",
+               stel->hostname, stel->port,
+               (long) stel->last, stel->seq );
     }
     fflush( st->st_fp );
 
@@ -138,7 +156,7 @@ St_update(
     }
 
     ldap_pvt_thread_mutex_lock( &(st->st_mutex ));
-    strcpy( stel->last, re->re_timestamp );
+    stel->last = re->re_timestamp;
     stel->seq = re->re_seq;
     ldap_pvt_thread_mutex_unlock( &(st->st_mutex ));
     return 0;
@@ -213,20 +231,25 @@ St_read(
 
        found = 0;
        for ( i = 0; i < sglob->st->st_nreplicas; i++ ) {
+           int p;
            if ( !strcmp( hostname, sglob->st->st_data[ i ]->hostname ) &&
-                   atoi( port ) == sglob->st->st_data[ i ]->port ) {
+                   lutil_atoi( &p, port ) == 0 && p == sglob->st->st_data[ i ]->port )
+           {
                found = 1;
-               strcpy( sglob->st->st_data[ i ]->last, timestamp );
-               sglob->st->st_data[ i ]->seq = atoi( seq );
+               if ( lutil_atol( &sglob->st->st_data[ i ]->last, timestamp ) != 0
+                       || lutil_atoi( &sglob->st->st_data[ i ]->seq, seq ) != 0 )
+               {
+                   found = 0;
+               }
                break;
            }
        }
        if ( found ) {
            char tbuf[ 255 ];
-           sprintf( tbuf, "%s:%s (timestamp %s.%s)", hostname, port,
-                   timestamp, seq );
+           sprintf( tbuf, "%s.%s", timestamp, seq );
            Debug( LDAP_DEBUG_ARGS,
-                   "Retrieved state information for %s\n", tbuf, 0, 0 );
+                   "Retrieved state information for %s:%s (timestamp %s)\n",
+                       hostname, port, tbuf );
        } else {
            Debug(  LDAP_DEBUG_ANY,
                    "Warning: saved state for %s:%s, not a known replica\n",