Skip to content

Commit

Permalink
rpc: fix heap-buffer-overflow reported by asan
Browse files Browse the repository at this point in the history
=================================================================
==11250==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000002219 at pc 0x7f4da51871ac bp 0x7f4da07fb17
0 sp 0x7f4da07fa918
READ of size 10 at 0x602000002219 thread T3
    #0 0x7f4da51871ab  (/lib64/libasan.so.5+0xba1ab)
    gluster#1 0x470883 in block_create_v2_1_svc_st /root/gluster-block/rpc/block_svc_routines.c:4517
    gluster#2 0x481ee2 in block_create_v2_1_svc /root/gluster-block/rpc/block_svc_routines.c:5340
    gluster#3 0x40c6cb in gluster_block_1 /root/gluster-block/rpc/rpcl/block_svc.c:99
    gluster#4 0x7f4da4ee4198 in svc_getreq_common (/lib64/libtirpc.so.3+0x18198)
    gluster#5 0x7f4da4ee4336 in svc_getreq_poll (/lib64/libtirpc.so.3+0x18336)
    gluster#6 0x7f4da4ee6b6d in svc_run (/lib64/libtirpc.so.3+0x1ab6d)
    gluster#7 0x405d2d in glusterBlockServerThreadProc /root/gluster-block/daemon/gluster-blockd.c:197
    gluster#8 0x7f4da50a158d in start_thread (/lib64/libpthread.so.0+0x858d)
    gluster#9 0x7f4da4e036a2 in clone (/lib64/libc.so.6+0xfd6a2)

0x602000002219 is located 0 bytes to the right of 9-byte region [0x602000002210,0x602000002219)
allocated by thread T3 here:
    #0 0x7f4da51bce10 in calloc (/lib64/libasan.so.5+0xefe10)
    gluster#1 0x7f4da4eeb18f in xdr_bytes (/lib64/libtirpc.so.3+0x1f18f)

Thread T3 created by T0 here:
    #0 0x7f4da511ff63 in __interceptor_pthread_create (/lib64/libasan.so.5+0x52f63)
    gluster#1 0x40bbc1 in main /root/gluster-block/daemon/gluster-blockd.c:600
    gluster#2 0x7f4da4d2a412 in __libc_start_main (/lib64/libc.so.6+0x24412)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/lib64/libasan.so.5+0xba1ab)

Signed-off-by: Prasanna Kumar Kalever <[email protected]>
  • Loading branch information
Prasanna Kumar Kalever committed Apr 15, 2019
1 parent 33d6e3d commit e0fe262
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion rpc/block_svc_routines.c
Original file line number Diff line number Diff line change
Expand Up @@ -4516,7 +4516,7 @@ block_create_v2_1_svc_st(blockCreate2 *blk, struct svc_req *rqstp)
convertTypeCreate2ToCreate(blk, &blk_v1);

if (len > 0 && len <= HOST_NAME_MAX) {
if (strcmp(blk->xdata.xdata_val, "localhost")) {
if (strncmp(blk->xdata.xdata_val, "localhost", 9)) {
if (GB_ALLOC_N(volServer, len) < 0)
goto err;
strncpy(volServer, blk->xdata.xdata_val, len);
Expand Down

0 comments on commit e0fe262

Please sign in to comment.