The use of malloc in clvmd.c's send_local_reply
function lacks a check to detect a NULL return value:
/* Send an aggregated reply back to the client */
static void send_local_reply(struct local_client *client, int status, int fd)
{
...
replybuf = malloc(message_len);
clientreply = (struct clvm_header *) replybuf;
clientreply->status = status;
...
It should log the failure, at least, rather than dereferencing NULL.
Is it important to get each message out? If so, it could fall back
on (or even use first) a static buffer that's large enough so that
most messages fit. But if the message is too long, it can still fail,
of course.
Unfortunately, there's no simple way to tell callers about this.
At first, I was going to suggest changing the return type, and
then adjusting the callers, where possible. But then I saw that
at least one caller (add_reply_to_list) is also a void function
(called from yet another void function), so even that starts to
look rather invasive.
_______________________________________________
linux-lvm mailing list
linux-lvm@redhat.com
https://www.redhat.com/mailman/listinfo/linux-lvm
read the LVM HOW-TO at http://tldp.org/HOWTO/LVM-HOWTO/
