From 46cd29a3a5f40744c41b863ccc5ce5381c4c621e Mon Sep 17 00:00:00 2001
From: Utz-Uwe Haus <uhaus@ela1.cscs.ch>
Date: Sat, 21 Nov 2020 22:42:40 +0100
Subject: [PATCH] Avoid READ buffer overrun when printing GNI EP description

---
 maestro/ofi.c | 50 +++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 41 insertions(+), 9 deletions(-)

diff --git a/maestro/ofi.c b/maestro/ofi.c
index be9651a4..8778bc13 100644
--- a/maestro/ofi.c
+++ b/maestro/ofi.c
@@ -1002,6 +1002,7 @@ BAILOUT:
 const char *
 mstro_ep_desc_describe(mstro_endpoint_descriptor desc)
 {
+  int s;
   /* FIXME: May need locking */
   if(desc==NULL)
     return "(null)";
@@ -1012,16 +1013,26 @@ mstro_ep_desc_describe(mstro_endpoint_descriptor desc)
       char *service = buf+2*MSTRO_EP_DESC_STRMAX;
       switch(desc->type) {
         case MSTRO_EP_OFI_IN4:
-          getnameinfo((struct sockaddr*)&desc->in4, sizeof(struct sockaddr_in),
+          s=getnameinfo((struct sockaddr*)&desc->in4, sizeof(struct sockaddr_in),
                       host, MSTRO_EP_DESC_STRMAX,
                       service, MSTRO_EP_DESC_STRMAX,
                       NI_NUMERICHOST | NI_NUMERICSERV);
+	  if(s!=0) {
+	    ERR("Failed to obtain IN4 address: %d (%s)\n",
+	        errno, strerror(errno));
+	    abort();
+	  }
           break;
         case MSTRO_EP_OFI_IN6:
-          getnameinfo((struct sockaddr*)&desc->in6, sizeof(struct sockaddr_in6),
+          s=getnameinfo((struct sockaddr*)&desc->in6, sizeof(struct sockaddr_in6),
                       host, MSTRO_EP_DESC_STRMAX,
                       service, MSTRO_EP_DESC_STRMAX,
                       NI_NUMERICHOST | NI_NUMERICSERV);
+	  if(s!=0) {
+	    ERR("Failed to obtain IN6 address: %d (%s)\n",
+	        errno, strerror(errno));
+	    abort();
+	  }
           break;
 #ifdef HAVE_IB
           /* case FI_SOCKADDR_IB: */
@@ -1030,22 +1041,38 @@ mstro_ep_desc_describe(mstro_endpoint_descriptor desc)
         case MSTRO_EP_OFI_PSMX:
         case MSTRO_EP_OFI_BGQ:
         case MSTRO_EP_OFI_MLX:
-          snprintf(host, MSTRO_EP_DESC_STRMAX,
-                   "[%" PRIu64 "]", desc->psmx);
+          s=snprintf(host, MSTRO_EP_DESC_STRMAX,
+		     "[%" PRIu64 "]", desc->psmx);
+          if(s<0 || s>MSTRO_EP_DESC_STRMAX) {
+	    ERR("Failed to write u64 address: %d (errno %d = %s)\n",
+	        s, errno, strerror(errno));
+	    abort();
+	  }
           service[0]='\0';
           break;
         case MSTRO_EP_OFI_PSMX2:
-          snprintf(host, MSTRO_EP_DESC_STRMAX,
+          s=snprintf(host, MSTRO_EP_DESC_STRMAX,
                    "[%"PRIu64":%"PRIu64"]", desc->psmx2[0], desc->psmx2[1]);
+          if(s<0 || s>MSTRO_EP_DESC_STRMAX) {
+	    ERR("Failed to write psmx2 address: %d (errno %d = %s)\n",
+	        s, errno, strerror(errno));
+	    abort();
+	  }
           service[0]='\0';
           break;
         case MSTRO_EP_OFI_GNI:
-          snprintf(host, MSTRO_EP_DESC_STRMAX,
+          s=snprintf(host, MSTRO_EP_DESC_STRMAX,
                    "[%" PRIu64 ":%" PRIu64 ":%" PRIu64 ":%" PRIu64 ":%" PRIu64 ":%" PRIu64 "/%s]",
                    desc->gni[0], desc->gni[1],
                    desc->gni[2], desc->gni[3],
                    desc->gni[4], desc->gni[5],
                    desc->oob_cookie);
+          if(s<0 || s>MSTRO_EP_DESC_STRMAX) {
+	    ERR("Failed to write GNI address: %d (errno %d = %s)\n",
+	        s, errno, strerror(errno));
+	    abort();
+	  }
+          service[0]='\0';
 	  break;
         case MSTRO_EP_OFI_STR:
           strcpy(host,desc->str);
@@ -1055,9 +1082,14 @@ mstro_ep_desc_describe(mstro_endpoint_descriptor desc)
           strcpy(host, "FIXME");
           service[0]='\0';
       }
-      snprintf(buf, MSTRO_EP_DESC_STRMAX, "EPD type %d (%s) addr %s:%s",
-               desc->type, mstro_ep_descriptor_names[desc->type],
-               host, service);
+      s=snprintf(buf, MSTRO_EP_DESC_STRMAX, "EPD type %d (%s) addr %s:%s",
+	         desc->type, mstro_ep_descriptor_names[desc->type],
+                 host, service);
+      if(s<0 || s>MSTRO_EP_DESC_STRMAX) {
+	      ERR("Failed to write endpoint description: %d (errno %d = %s)\n",
+	      s, errno, strerror(errno));
+	      abort();
+      }
       
       desc->name = buf;
     }
-- 
GitLab