Pārlūkot izejas kodu

ncd: Fix bugs with bad expectations of null-terminated strings.

Ambroz Bizjak 11 gadi atpakaļ
vecāks
revīzija
0f28a138b9
2 mainītis faili ar 39 papildinājumiem un 19 dzēšanām
  1. 20 10
      ncd/modules/load_module.c
  2. 19 9
      ncd/modules/net_backend_badvpn.c

+ 20 - 10
ncd/modules/load_module.c

@@ -234,21 +234,27 @@ static void func_new (void *unused, NCDModuleInst *i, const struct NCDModuleInst
         goto fail0;
     }
     
-    struct module *mod = find_module(NCDVal_StringData(name_arg), ModuleGlobal(i));
+    NCDValNullTermString name_nts;
+    if (!NCDVal_StringNullTerminate(name_arg, &name_nts)) {
+        ModuleLog(i, BLOG_ERROR, "NCDVal_StringNullTerminate failed");
+        goto fail0;
+    }
+    
+    struct module *mod = find_module(name_nts.data, ModuleGlobal(i));
     ASSERT(!mod || mod->lib_handle)
     
     if (!mod) {
-        mod = module_init(NCDVal_StringData(name_arg), i);
+        mod = module_init(name_nts.data, i);
         if (!mod) {
             ModuleLog(i, BLOG_ERROR, "module_init failed");
-            goto fail0;
+            goto fail1;
         }
         
         // find module library
-        char *module_path = find_module_library(i, NCDVal_StringData(name_arg));
+        char *module_path = find_module_library(i, name_nts.data);
         if (!module_path) {
             module_free(mod, ModuleGlobal(i));
-            goto fail0;
+            goto fail1;
         }
         
         // load it as a dynamic library
@@ -257,16 +263,16 @@ static void func_new (void *unused, NCDModuleInst *i, const struct NCDModuleInst
         if (!mod->lib_handle) {
             ModuleLog(i, BLOG_ERROR, "dlopen failed");
             module_free(mod, ModuleGlobal(i));
-            goto fail0;
+            goto fail1;
         }
     }
     
     if (!mod->ncdmodule_loaded) {
         // build name of NCDModuleGroup structure symbol
-        char *group_symbol = concat_strings(2, "ncdmodule_", NCDVal_StringData(name_arg));
+        char *group_symbol = concat_strings(2, "ncdmodule_", name_nts.data);
         if (!group_symbol) {
             ModuleLog(i, BLOG_ERROR, "concat_strings failed");
-            goto fail0;
+            goto fail1;
         }
         
         // resolve NCDModuleGroup structure symbol
@@ -274,22 +280,26 @@ static void func_new (void *unused, NCDModuleInst *i, const struct NCDModuleInst
         BFree(group_symbol);
         if (!group) {
             ModuleLog(i, BLOG_ERROR, "dlsym failed");
-            goto fail0;
+            goto fail1;
         }
         
         // load module group
         if (!NCDModuleInst_Backend_InterpLoadGroup(i, (struct NCDModuleGroup *)group)) {
             ModuleLog(i, BLOG_ERROR, "NCDModuleInst_Backend_InterpLoadGroup failed");
-            goto fail0;
+            goto fail1;
         }
         
         mod->ncdmodule_loaded = 1;
     }
     
+    NCDValNullTermString_Free(&name_nts);
+    
     // signal up
     NCDModuleInst_Backend_Up(i);
     return;
     
+fail1:
+    NCDValNullTermString_Free(&name_nts);
 fail0:
     NCDModuleInst_Backend_DeadError(i);
 }

+ 19 - 9
ncd/modules/net_backend_badvpn.c

@@ -48,7 +48,7 @@
 struct instance {
     NCDModuleInst *i;
     NCDValNullTermString ifname_nts;
-    MemRef user;
+    NCDValNullTermString user_nts;
     MemRef exec;
     NCDValRef args;
     int dying;
@@ -94,7 +94,7 @@ void try_process (struct instance *o)
     }
     
     // start process
-    if (!BProcess_Init(&o->process, o->i->params->iparams->manager, (BProcess_handler)process_handler, o, ((char **)c.arr.v)[0], (char **)c.arr.v, o->user.ptr)) {
+    if (!BProcess_Init(&o->process, o->i->params->iparams->manager, (BProcess_handler)process_handler, o, ((char **)c.arr.v)[0], (char **)c.arr.v, o->user_nts.data)) {
         ModuleLog(o->i, BLOG_ERROR, "BProcess_Init failed");
         goto fail1;
     }
@@ -165,7 +165,6 @@ static void func_new (void *vo, NCDModuleInst *i, const struct NCDModuleInst_new
         goto fail0;
     }
     
-    o->user = NCDVal_StringMemRef(user_arg);
     o->exec = NCDVal_StringMemRef(exec_arg);
     o->args = args_arg;
     
@@ -179,22 +178,28 @@ static void func_new (void *vo, NCDModuleInst *i, const struct NCDModuleInst_new
         }
     }
     
+    // null terminate user
+    if (!NCDVal_StringNullTerminate(user_arg, &o->user_nts)) {
+        ModuleLog(i, BLOG_ERROR, "NCDVal_StringNullTerminate failed");
+        goto fail0;
+    }
+    
     // null terminate ifname
     if (!NCDVal_StringNullTerminate(ifname_arg, &o->ifname_nts)) {
         ModuleLog(i, BLOG_ERROR, "NCDVal_StringNullTerminate failed");
-        goto fail0;
+        goto fail1;
     }
     
     // create TAP device
-    if (!NCDIfConfig_make_tuntap(o->ifname_nts.data, o->user.ptr, 0)) {
+    if (!NCDIfConfig_make_tuntap(o->ifname_nts.data, o->user_nts.data, 0)) {
         ModuleLog(o->i, BLOG_ERROR, "failed to create TAP device");
-        goto fail1;
+        goto fail2;
     }
     
     // set device up
     if (!NCDIfConfig_set_up(o->ifname_nts.data)) {
         ModuleLog(o->i, BLOG_ERROR, "failed to set device up");
-        goto fail2;
+        goto fail3;
     }
     
     // set not dying
@@ -210,12 +215,14 @@ static void func_new (void *vo, NCDModuleInst *i, const struct NCDModuleInst_new
     try_process(o);
     return;
     
-fail2:
+fail3:
     if (!NCDIfConfig_remove_tuntap(o->ifname_nts.data, 0)) {
         ModuleLog(o->i, BLOG_ERROR, "failed to remove TAP device");
     }
-fail1:
+fail2:
     NCDValNullTermString_Free(&o->ifname_nts);
+fail1:
+    NCDValNullTermString_Free(&o->user_nts);
 fail0:
     NCDModuleInst_Backend_DeadError(i);
 }
@@ -240,6 +247,9 @@ void instance_free (struct instance *o)
     // free ifname nts
     NCDValNullTermString_Free(&o->ifname_nts);
     
+    // free user nts
+    NCDValNullTermString_Free(&o->user_nts);
+    
     NCDModuleInst_Backend_Dead(o->i);
 }