From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matthew Daley Subject: [PATCH 20/28] xenstore: check socket path length before copying it Date: Wed, 18 Sep 2013 15:37:56 +1200 Message-ID: <1379475484-25993-21-git-send-email-mattjd@gmail.com> References: <1379475484-25993-1-git-send-email-mattjd@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1379475484-25993-1-git-send-email-mattjd@gmail.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: xen-devel@lists.xen.org Cc: Matthew Daley , Ian Jackson , Ian Campbell , Stefano Stabellini List-Id: xen-devel@lists.xenproject.org Coverity-ID: 1055997 Signed-off-by: Matthew Daley --- tools/xenstore/xs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tools/xenstore/xs.c b/tools/xenstore/xs.c index 86ef6c7..b1e6820 100644 --- a/tools/xenstore/xs.c +++ b/tools/xenstore/xs.c @@ -196,6 +196,10 @@ static int get_socket(const char *connect_to) goto error; addr.sun_family = AF_UNIX; + if(strlen(connect_to) >= sizeof(addr.sun_path)) { + errno = EINVAL; + goto error; + } strcpy(addr.sun_path, connect_to); if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) != 0) -- 1.7.10.4