Commit da429bd4 authored by Cyrill Gorcunov's avatar Cyrill Gorcunov Committed by Pavel Emelyanov

lib: Don't use alloca over net received size

Better to obtain error if there is no free memory
than smashing the stack.

A rule of thumb for alloca() based functions is to
use them with predefined small sizes (such as we
do in swapping builtin sizes for parasite engine).
Signed-off-by: 's avatarCyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: 's avatarPavel Emelyanov <xemul@parallels.com>
parent 4c00ac29
...@@ -10,7 +10,6 @@ ...@@ -10,7 +10,6 @@
#include <stdlib.h> #include <stdlib.h>
#include <errno.h> #include <errno.h>
#include <signal.h> #include <signal.h>
#include <alloca.h>
#include "criu.h" #include "criu.h"
#include "rpc.pb-c.h" #include "rpc.pb-c.h"
...@@ -724,7 +723,7 @@ int criu_add_irmap_path(char *path) ...@@ -724,7 +723,7 @@ int criu_add_irmap_path(char *path)
static CriuResp *recv_resp(int socket_fd) static CriuResp *recv_resp(int socket_fd)
{ {
unsigned char *buf; unsigned char *buf = NULL;
int len; int len;
CriuResp *msg = 0; CriuResp *msg = 0;
...@@ -734,7 +733,12 @@ static CriuResp *recv_resp(int socket_fd) ...@@ -734,7 +733,12 @@ static CriuResp *recv_resp(int socket_fd)
goto err; goto err;
} }
buf = alloca(len); buf = malloc(len);
if (!buf) {
errno = ENOMEM;
perror("Can't receive response");
goto err;
}
len = recv(socket_fd, buf, len, MSG_TRUNC); len = recv(socket_fd, buf, len, MSG_TRUNC);
if (len == -1) { if (len == -1) {
...@@ -748,8 +752,10 @@ static CriuResp *recv_resp(int socket_fd) ...@@ -748,8 +752,10 @@ static CriuResp *recv_resp(int socket_fd)
goto err; goto err;
} }
free(buf);
return msg; return msg;
err: err:
free(buf);
saved_errno = errno; saved_errno = errno;
return NULL; return NULL;
} }
...@@ -761,7 +767,12 @@ static int send_req(int socket_fd, CriuReq *req) ...@@ -761,7 +767,12 @@ static int send_req(int socket_fd, CriuReq *req)
len = criu_req__get_packed_size(req); len = criu_req__get_packed_size(req);
buf = alloca(len); buf = malloc(len);
if (!buf) {
errno = ENOMEM;
perror("Can't send request");
goto err;
}
if (criu_req__pack(req, buf) != len) { if (criu_req__pack(req, buf) != len) {
perror("Failed packing request"); perror("Failed packing request");
...@@ -773,8 +784,10 @@ static int send_req(int socket_fd, CriuReq *req) ...@@ -773,8 +784,10 @@ static int send_req(int socket_fd, CriuReq *req)
goto err; goto err;
} }
free(buf);
return 0; return 0;
err: err:
free(buf);
saved_errno = errno; saved_errno = errno;
return -1; return -1;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment