From 3a606b7d91e68ed26242c8d4f37aa631ae74d750 Mon Sep 17 00:00:00 2001 From: Daniel O'Connor Date: Fri, 22 Jun 2012 21:47:30 +0930 Subject: [PATCH] Check the socket isn't too long before copying it to prevent a seg fault. --- overlay_mdp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/overlay_mdp.c b/overlay_mdp.c index 4fd525b8..5e50b286 100644 --- a/overlay_mdp.c +++ b/overlay_mdp.c @@ -1206,6 +1206,9 @@ int overlay_mdp_client_init() overlay_mdp_client_socket_path_len=strlen(overlay_mdp_client_socket_path)+1; if(debug&DEBUG_IO) DEBUGF("MDP client socket name='%s'",overlay_mdp_client_socket_path); } + if (overlay_mdp_client_socket_path_len > 104 - 1) + FATALF("MDP socket path too long (%d > %d)", overlay_mdp_client_socket_path_len, 104 - 1); + bcopy(overlay_mdp_client_socket_path,name.sun_path, overlay_mdp_client_socket_path_len); unlink(name.sun_path);