6953064 iscsiadm modify discovery -t enable panics system with "kernel heap corruption detected"

5 files changed, 25 insertions, 16 deletions

diff --git a/usr/src/cmd/iscsiadm/iscsiadm_main.c b/usr/src/cmd/iscsiadm/iscsiadm_main.c
index 221aa69e27..7a4d1ad54b 100644
--- a/usr/src/cmd/iscsiadm/iscsiadm_main.c
+++ b/usr/src/cmd/iscsiadm/iscsiadm_main.c
@@ -3107,6 +3107,7 @@ modifyNodeAuthParam(IMA_OID oid, int param, char *chapName, int *funcRet)
 	IMA_STATUS status;
 	int ret;
 	int secretLen = MAX_CHAP_SECRET_LEN;
+	int nameLen = 0;
 
 	IMA_BYTE chapSecret[MAX_CHAP_SECRET_LEN + 1];
 
@@ -3126,15 +3127,20 @@ modifyNodeAuthParam(IMA_OID oid, int param, char *chapName, int *funcRet)
 			(void) fprintf(stderr, "CHAP name cannot be NULL.\n");
 			return (1);
 		}
-		if (strlen(chapName) == 0) {
+		nameLen = strlen(chapName);
+		if (nameLen == 0) {
 			(void) fprintf(stderr, "CHAP name cannot be empty.\n");
 			return (1);
 		}
+		if (nameLen > ISCSI_MAX_C_USER_LEN) {
+			(void) fprintf(stderr, "CHAP name is too long.\n");
+			return (1);
+		}
 		(void) memset(&authParams.chapParms.name, 0,
 		    sizeof (authParams.chapParms.name));
 		(void) memcpy(&authParams.chapParms.name,
-		    &chapName[0], strlen(chapName));
-		authParams.chapParms.nameLength = strlen(chapName);
+		    &chapName[0], nameLen);
+		authParams.chapParms.nameLength = nameLen;
 		break;
 
 	case AUTH_PASSWORD :
@@ -3176,6 +3182,7 @@ modifyTargetAuthParam(IMA_OID oid, int param, char *chapName, int *funcRet)
 	IMA_STATUS status;
 	int ret;
 	int secretLen = MAX_CHAP_SECRET_LEN;
+	int nameLen = 0;
 
 	IMA_BYTE chapSecret[MAX_CHAP_SECRET_LEN + 1];
 
@@ -3195,15 +3202,20 @@ modifyTargetAuthParam(IMA_OID oid, int param, char *chapName, int *funcRet)
 			(void) fprintf(stderr, "CHAP name cannot be NULL.\n");
 			return (1);
 		}
-		if (strlen(chapName) == 0) {
+		nameLen = strlen(chapName);
+		if (nameLen == 0) {
 			(void) fprintf(stderr, "CHAP name cannot be empty.\n");
 			return (1);
 		}
+		if (nameLen > ISCSI_MAX_C_USER_LEN) {
+			(void) fprintf(stderr, "CHAP name is too long.\n");
+			return (1);
+		}
 		(void) memset(&authParams.chapParms.name, 0,
 		    sizeof (authParams.chapParms.name));
 		(void) memcpy(&authParams.chapParms.name,
-		    &chapName[0], strlen(chapName));
-		authParams.chapParms.nameLength = strlen(chapName);
+		    &chapName[0], nameLen);
+		authParams.chapParms.nameLength = nameLen;
 		break;
 
 	case AUTH_PASSWORD :
diff --git a/usr/src/uts/common/io/scsi/adapters/iscsi/iscsiAuthClient.h b/usr/src/uts/common/io/scsi/adapters/iscsi/iscsiAuthClient.h
index 3d1a44dd56..d6af66d205 100644
--- a/usr/src/uts/common/io/scsi/adapters/iscsi/iscsiAuthClient.h
+++ b/usr/src/uts/common/io/scsi/adapters/iscsi/iscsiAuthClient.h
@@ -20,8 +20,7 @@
  */
 /*
  * Copyright 2000 by Cisco Systems, Inc.  All rights reserved.
- * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
- * Use is subject to license terms.
+ * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
  */
 
 #ifndef	_ISCSIAUTHCLIENT_H
@@ -35,7 +34,7 @@
 extern "C" {
 #endif
 
-enum { iscsiAuthStringMaxLength = 256 };
+enum { iscsiAuthStringMaxLength = 512 };
 enum { iscsiAuthStringBlockMaxLength = 1024 };
 enum { iscsiAuthLargeBinaryMaxLength = 1024 };
 
diff --git a/usr/src/uts/common/sys/iscsi_authclient.h b/usr/src/uts/common/sys/iscsi_authclient.h
index 2d0756c07a..5abf6dabdb 100644
--- a/usr/src/uts/common/sys/iscsi_authclient.h
+++ b/usr/src/uts/common/sys/iscsi_authclient.h
@@ -20,14 +20,12 @@
  */
 /*
  * Copyright 2000 by Cisco Systems, Inc.  All rights reserved.
- * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
- * Use is subject to license terms.
+ * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
  */
 
 #ifndef	_ISCSI_AUTHCLIENT_H
 #define	_ISCSI_AUTHCLIENT_H
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
 
 /*
  * This file is the include file for for iscsiAuthClient.c
@@ -37,7 +35,7 @@
 extern "C" {
 #endif
 
-enum { iscsiAuthStringMaxLength = 256 };
+enum { iscsiAuthStringMaxLength = 512 };
 enum { iscsiAuthStringBlockMaxLength = 1024 };
 enum { iscsiAuthLargeBinaryMaxLength = 1024 };
 
diff --git a/usr/src/uts/common/sys/iscsi_protocol.h b/usr/src/uts/common/sys/iscsi_protocol.h
index e474021498..da2ef15d80 100644
--- a/usr/src/uts/common/sys/iscsi_protocol.h
+++ b/usr/src/uts/common/sys/iscsi_protocol.h
@@ -19,8 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
- * Use is subject to license terms.
+ * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
  */
 
 #ifndef _ISCSI_PROTOCOL_H
@@ -44,6 +43,7 @@ extern "C" {
 #include <sys/isa_defs.h>
 
 #define	ISCSI_MAX_NAME_LEN	224
+#define	ISCSI_MAX_C_USER_LEN	512
 
 /* iSCSI listen port for incoming connections */
 #define	ISCSI_LISTEN_PORT 3260
diff --git a/usr/src/uts/common/sys/scsi/adapters/iscsi_if.h b/usr/src/uts/common/sys/scsi/adapters/iscsi_if.h
index 2b1e80cb8c..501ea9bab1 100644
--- a/usr/src/uts/common/sys/scsi/adapters/iscsi_if.h
+++ b/usr/src/uts/common/sys/scsi/adapters/iscsi_if.h
@@ -341,7 +341,7 @@ typedef struct chap_props {
 	uint32_t		c_vers,
 				c_retries,
 				c_oid;
-	unsigned char		c_user[128];
+	unsigned char		c_user[ISCSI_MAX_C_USER_LEN];
 	uint32_t		c_user_len;
 	unsigned char		c_secret[16];
 	uint32_t		c_secret_len;