fixedpoint: fix buffer overflow in fixed point computations

[thirdparty/lldpd.git] / src / ctl.c

diff --git a/src/ctl.c b/src/ctl.c
index 3a88f0ec0026825dc9f583bb0a2b07311fe2da93..a347908eaf5e429a1e5fcd71a8ecc5842ef06543 100644 (file)
--- a/src/ctl.c
+++ b/src/ctl.c
@@ -36,7 +36,7 @@
  * @return The socket when successful, -1 otherwise.
  */
 int
-ctl_create(char *name)
+ctl_create(const char *name)
 {
        int s;
        struct sockaddr_un su;
@@ -46,6 +46,10 @@ ctl_create(char *name)
 
        if ((s = socket(PF_UNIX, SOCK_STREAM, 0)) == -1)
                return -1;
+       if (fcntl(s, F_SETFD, FD_CLOEXEC) == -1) {
+               close(s);
+               return -1;
+       }
        su.sun_family = AF_UNIX;
        strlcpy(su.sun_path, name, sizeof(su.sun_path));
        if (bind(s, (struct sockaddr *)&su, sizeof(struct sockaddr_un)) == -1) {
@@ -69,7 +73,7 @@ ctl_create(char *name)
  * @return The socket when successful, -1 otherwise.
  */
 int
-ctl_connect(char *name)
+ctl_connect(const char *name)
 {
        int s;
        struct sockaddr_un su;
@@ -84,6 +88,7 @@ ctl_connect(char *name)
        if (connect(s, (struct sockaddr *)&su, sizeof(struct sockaddr_un)) == -1) {
                rc = errno;
                log_warn("control", "unable to connect to socket %s", name);
+               close(s);
                errno = rc; return -1;
        }
        return s;
@@ -95,7 +100,7 @@ ctl_connect(char *name)
  * @param name The name of the Unix socket.
  */
 void
-ctl_cleanup(char *name)
+ctl_cleanup(const char *name)
 {
        log_debug("control", "cleanup control socket");
        if (unlink(name) == -1)
@@ -124,7 +129,6 @@ ctl_msg_send_unserialized(uint8_t **output_buffer, size_t *output_len,
     enum hmsg_type type,
     void *t, struct marshal_info *mi)
 {
-       struct hmsg_header hdr;
        ssize_t len = 0, newlen;
        void *buffer = NULL;
 
@@ -155,9 +159,11 @@ ctl_msg_send_unserialized(uint8_t **output_buffer, size_t *output_len,
                }
                *output_buffer = new;
        }
+
+       struct hmsg_header hdr;
        memset(&hdr, 0, sizeof(struct hmsg_header));
        hdr.type = type;
-       hdr.len  = len;
+       hdr.len = len;
        memcpy(*output_buffer + *output_len, &hdr, sizeof(struct hmsg_header));
        if (t)
                memcpy(*output_buffer + *output_len + sizeof(struct hmsg_header), buffer, len);