[HADOOP-9635] Fix Potential Stack Overflow in DomainSocket.c

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.3.0
• Fix Version/s: 2.3.0
• Component/s: native
• Labels: patch security

Environment

OSX 10.8

• Assignee: Unassigned
• Reporter: V. Karthik Kumar
• Created: 09/Jun/13 00:21
• Updated: 24/Feb/14 20:57
• Resolved: 11/Jun/13 20:31

Description

When I was running on OSX, the DataNode was segfaulting. On investigation, it was tracked down to this code. A potential stack overflow was also identified.

   utfLength = (*env)->GetStringUTFLength(env, jstr);
   if (utfLength > sizeof(path)) {
     jthr = newIOException(env, "path is too long!  We expected a path "
         "no longer than %zd UTF-8 bytes.", sizeof(path));
     goto done;
   }
  // GetStringUTFRegion does not pad with NUL
   (*env)->GetStringUTFRegion(env, jstr, 0, utfLength, path);

...

  //strtok_r can set rest pointer to NULL when no tokens found.
  //Causes JVM to crash in rest[0]
   for (check[0] = '/', check[1] = '\0', rest = path, token = "";
       token && rest[0];
        token = strtok_r(rest, "/", &rest)) {