Jim Chen has uploaded this change for review.
client_mgr: prevent heap overflow in grpc_cltmgr_show_clients
grpc_cltmgr_show_clients() performs two separate foreach_gsh_client()
passes without holding client_by_ip.cip_lock across both passes. In pass
1 it counts active clients and allocates show->clients for that count; in
pass 2 it populates show->clients via grpc_show_fill_cb().
If new clients connect between pass 1 and pass 2, grpc_show_fill_cb()
increments st->index past the allocated show->clients array capacity,
causing a heap buffer overflow. Conversely, if clients are removed
between pass 1 and pass 2, show->client_count remains larger than
fill_st.index, leaving trailing array elements uninitialized.
Track max_count in struct grpc_show_fill_state, stop iterating in
grpc_show_fill_cb() once st->index reaches st->max_count, and update
show->client_count to fill_st.index after pass 2 completes.
Change-Id: Idff3fbb409ba87348823ecbddefa834fa77cf61e
Signed-off-by: Jim Chen <czcbangkai@google.com>
---
M src/support/client_mgr.c
1 file changed, 9 insertions(+), 1 deletion(-)
git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/76/1257476/1
To view, visit change 1257476. To unsubscribe, or for help writing mail filters, visit settings.