server: ensure that incoming iolog name is NULL terminated

[fio.git] / server.c

diff --git a/server.c b/server.c
index 73866d770e3f3dc7722bec9434f70b054cd5e1cb..077dce5c349f67efec5c76a6371e89e2a2a4724f 100644 (file)
--- a/server.c
+++ b/server.c
@@ -4,7 +4,6 @@
 #include <unistd.h>
 #include <limits.h>
 #include <errno.h>
-#include <fcntl.h>
 #include <sys/poll.h>
 #include <sys/types.h>
 #include <sys/wait.h>
@@ -68,7 +67,7 @@ static const char *fio_server_ops[FIO_NET_CMD_NR] = {
        "DISK_UTIL",
        "SERVER_START",
        "ADD_JOB",
-       "CMD_RUN"
+       "CMD_RUN",
        "CMD_IOLOG",
 };
 
@@ -209,7 +208,7 @@ static int verify_convert_cmd(struct fio_net_cmd *cmd)
  */
 struct fio_net_cmd *fio_net_recv_cmd(int sk)
 {
-       struct fio_net_cmd cmd, *cmdret = NULL;
+       struct fio_net_cmd cmd, *tmp, *cmdret = NULL;
        size_t cmd_size = 0, pdu_offset = 0;
        uint16_t crc;
        int ret, first = 1;
@@ -232,7 +231,19 @@ struct fio_net_cmd *fio_net_recv_cmd(int sk)
                } else
                        cmd_size += cmd.pdu_len;
 
-               cmdret = realloc(cmdret, cmd_size);
+               if (cmd_size / 1024 > FIO_SERVER_MAX_CMD_MB * 1024) {
+                       log_err("fio: cmd+pdu too large (%llu)\n", (unsigned long long) cmd_size);
+                       ret = 1;
+                       break;
+               }
+
+               tmp = realloc(cmdret, cmd_size);
+               if (!tmp) {
+                       log_err("fio: server failed allocating cmd\n");
+                       ret = 1;
+                       break;
+               }
+               cmdret = tmp;
 
                if (first)
                        memcpy(cmdret, &cmd, sizeof(cmd));
@@ -843,14 +854,12 @@ static int accept_loop(int listen_sk)
        struct sockaddr_in6 addr6;
        socklen_t len = use_ipv6 ? sizeof(addr6) : sizeof(addr);
        struct pollfd pfd;
-       int ret = 0, sk, flags, exitval = 0;
+       int ret = 0, sk, exitval = 0;
        FLIST_HEAD(conn_list);
 
        dprint(FD_NET, "server enter accept loop\n");
 
-       flags = fcntl(listen_sk, F_GETFL);
-       flags |= O_NONBLOCK;
-       fcntl(listen_sk, F_SETFL, flags);
+       fio_set_fd_nonblocking(listen_sk, "server");
 
        while (!exit_backend) {
                const char *from;
@@ -1095,18 +1104,19 @@ static void convert_dus(struct disk_util_stat *dst, struct disk_util_stat *src)
 {
        int i;
 
-       strcpy((char *) dst->name, (char *) src->name);
+       dst->name[FIO_DU_NAME_SZ - 1] = '\0';
+       strncpy((char *) dst->name, (char *) src->name, FIO_DU_NAME_SZ - 1);
 
        for (i = 0; i < 2; i++) {
-               dst->ios[i]     = cpu_to_le32(src->ios[i]);
-               dst->merges[i]  = cpu_to_le32(src->merges[i]);
-               dst->sectors[i] = cpu_to_le64(src->sectors[i]);
-               dst->ticks[i]   = cpu_to_le32(src->ticks[i]);
+               dst->s.ios[i]           = cpu_to_le32(src->s.ios[i]);
+               dst->s.merges[i]        = cpu_to_le32(src->s.merges[i]);
+               dst->s.sectors[i]       = cpu_to_le64(src->s.sectors[i]);
+               dst->s.ticks[i]         = cpu_to_le32(src->s.ticks[i]);
        }
 
-       dst->io_ticks           = cpu_to_le32(src->io_ticks);
-       dst->time_in_queue      = cpu_to_le32(src->time_in_queue);
-       dst->msec               = cpu_to_le64(src->msec);
+       dst->s.io_ticks         = cpu_to_le32(src->s.io_ticks);
+       dst->s.time_in_queue    = cpu_to_le32(src->s.time_in_queue);
+       dst->s.msec             = cpu_to_le64(src->s.msec);
 }
 
 void fio_server_send_du(void)
@@ -1215,7 +1225,9 @@ int fio_send_iolog(struct thread_data *td, struct io_log *log, const char *name)
        pdu.nr_samples = __cpu_to_le32(log->nr_samples);
        pdu.log_type = cpu_to_le32(log->log_type);
        pdu.compressed = cpu_to_le32(use_zlib);
-       strcpy((char *) pdu.name, name);
+
+       strncpy((char *) pdu.name, name, FIO_NET_NAME_MAX);
+       pdu.name[FIO_NET_NAME_MAX - 1] = '\0';
 
        for (i = 0; i < log->nr_samples; i++) {
                struct io_sample *s = &log->log[i];
@@ -1338,7 +1350,7 @@ static int fio_init_server_sock(void)
 
        memset(&addr, 0, sizeof(addr));
        addr.sun_family = AF_UNIX;
-       strcpy(addr.sun_path, bind_sock);
+       strncpy(addr.sun_path, bind_sock, sizeof(addr.sun_path) - 1);
 
        len = sizeof(addr.sun_family) + strlen(bind_sock) + 1;
 
@@ -1367,6 +1379,8 @@ static int fio_init_server_connection(void)
        if (sk < 0)
                return sk;
 
+       memset(bind_str, 0, sizeof(bind_str));
+
        if (!bind_sock) {
                char *p, port[16];
                const void *src;
@@ -1386,9 +1400,9 @@ static int fio_init_server_connection(void)
                if (p)
                        strcat(p, port);
                else
-                       strcpy(bind_str, port);
+                       strncpy(bind_str, port, sizeof(bind_str) - 1);
        } else
-               strcpy(bind_str, bind_sock);
+               strncpy(bind_str, bind_sock, sizeof(bind_str) - 1);
 
        log_info("fio: server listening on %s\n", bind_str);