DEVEL15-auth-cellconfig-overflow-20090601

LICENSE IPL10
FIXES 124891

(cherry picked from commit e89f90f7f17efc80c984b2858cd85a87f8cdfbf3)

diff --git a/src/auth/cellconfig.c b/src/auth/cellconfig.c
index 93afac5..daa69dd 100644 (file)
--- a/src/auth/cellconfig.c
+++ b/src/auth/cellconfig.c
@@ -725,31 +725,41 @@ afsconf_OpenInternal(register struct afsconf_dir *adir, char *cell,
                return -1;
            }
            i = curEntry->cellInfo.numServers;
-           if (cell && !strcmp(cell, curEntry->cellInfo.name))
-               code =
-                   ParseHostLine(tbuffer, &curEntry->cellInfo.hostAddr[i],
-                                 curEntry->cellInfo.hostName[i], &clones[i]);
-           else
-               code =
-                   ParseHostLine(tbuffer, &curEntry->cellInfo.hostAddr[i],
-                                 curEntry->cellInfo.hostName[i], 0);
-           if (code) {
-               if (code == AFSCONF_SYNTAX) {
-                   for (bp = tbuffer; *bp != '\n'; bp++) {     /* Take out the <cr> from the buffer */
-                       if (!*bp)
-                           break;
+           if (i < MAXHOSTSPERCELL) {
+               if (cell && !strcmp(cell, curEntry->cellInfo.name))
+                   code =
+                       ParseHostLine(tbuffer, 
+                                     &curEntry->cellInfo.hostAddr[i],
+                                     curEntry->cellInfo.hostName[i], 
+                                     &clones[i]);
+               else
+                   code =
+                       ParseHostLine(tbuffer, 
+                                     &curEntry->cellInfo.hostAddr[i],
+                                     curEntry->cellInfo.hostName[i], 0);
+
+               if (code) {
+                   if (code == AFSCONF_SYNTAX) {
+                       for (bp = tbuffer; *bp != '\n'; bp++) { /* Take out the <cr> from the buffer */
+                           if (!*bp)
+                               break;
+                       }
+                       *bp = '\0';
+                       fprintf(stderr,
+                               "Can't properly parse host line \"%s\" in configuration file %s\n",
+                               tbuffer, tbuf1);
                    }
-                   *bp = '\0';
-                   fprintf(stderr,
-                           "Can't properly parse host line \"%s\" in configuration file %s\n",
-                           tbuffer, tbuf1);
+                   free(curEntry);
+                   fclose(tf);
+                   afsconf_CloseInternal(adir);
+                   return -1;
                }
-               free(curEntry);
-               fclose(tf);
-               afsconf_CloseInternal(adir);
-               return -1;
+               curEntry->cellInfo.numServers = ++i;
+           } else {
+               fprintf(stderr,
+                       "Too many hosts for cell %s in configuration file %s\n", 
+                       curEntry->cellInfo.name, tbuf1);
            }
-           curEntry->cellInfo.numServers = ++i;
        }
     }
     fclose(tf);                        /* close the file now */