From 7e0783a5a813c40c5dab87192155b301e48272b2 Mon Sep 17 00:00:00 2001
From: Hui Li <huili@taosdata.com>
Date: Fri, 29 May 2020 16:22:44 +0800
Subject: [PATCH] [TD-439]

---
 src/dnode/src/dnodeMgmt.c        | 6 ++++--
 src/dnode/src/dnodeSystem.c      | 8 ++++++--
 src/kit/shell/src/shellDarwin.c  | 8 ++++++--
 src/kit/shell/src/shellLinux.c   | 5 +++++
 src/kit/shell/src/shellWindows.c | 8 ++++++--
 src/plugins/http/src/tgHandle.c  | 2 +-
 src/util/src/tconfig.c           | 7 ++++++-
 7 files changed, 34 insertions(+), 10 deletions(-)

diff --git a/src/dnode/src/dnodeMgmt.c b/src/dnode/src/dnodeMgmt.c
index c4a07518ea..14c2a725d9 100644
--- a/src/dnode/src/dnodeMgmt.c
+++ b/src/dnode/src/dnodeMgmt.c
@@ -369,7 +369,8 @@ static void dnodeUpdateMnodeInfos(SDMMnodeInfos *pMnodes) {
 }
 
 static bool dnodeReadMnodeInfos() {
-  char ipFile[TSDB_FILENAME_LEN] = {0};
+  char ipFile[TSDB_FILENAME_LEN*2] = {0};
+  
   sprintf(ipFile, "%s/mnodeIpList.json", tsDnodeDir);
   FILE *fp = fopen(ipFile, "r");
   if (!fp) {
@@ -537,7 +538,8 @@ static void dnodeSendStatusMsg(void *handle, void *tmrId) {
 }
 
 static bool dnodeReadDnodeCfg() {
-  char dnodeCfgFile[TSDB_FILENAME_LEN] = {0};
+  char dnodeCfgFile[TSDB_FILENAME_LEN*2] = {0};
+  
   sprintf(dnodeCfgFile, "%s/dnodeCfg.json", tsDnodeDir);
 
   FILE *fp = fopen(dnodeCfgFile, "r");
diff --git a/src/dnode/src/dnodeSystem.c b/src/dnode/src/dnodeSystem.c
index a7bfc2d7d2..0f8dabd75a 100644
--- a/src/dnode/src/dnodeSystem.c
+++ b/src/dnode/src/dnodeSystem.c
@@ -28,8 +28,12 @@ int32_t main(int32_t argc, char *argv[]) {
   // Set global configuration file
   for (int32_t i = 1; i < argc; ++i) {
     if (strcmp(argv[i], "-c") == 0) {
-      if (i < argc - 1) {
-        strcpy(configDir, argv[++i]);
+      if (i < argc - 1) {        
+        if (strlen(argv[++i]) > TSDB_FILENAME_LEN - 1) {
+          printf("config file path overflow");
+          exit(EXIT_FAILURE);
+        }
+        strcpy(configDir, argv[i]);
       } else {
         printf("'-c' requires a parameter, default:%s\n", configDir);
         exit(EXIT_FAILURE);
diff --git a/src/kit/shell/src/shellDarwin.c b/src/kit/shell/src/shellDarwin.c
index 98ea6510d7..439ca6edad 100644
--- a/src/kit/shell/src/shellDarwin.c
+++ b/src/kit/shell/src/shellDarwin.c
@@ -96,8 +96,12 @@ void shellParseArgument(int argc, char *argv[], struct arguments *arguments) {
         exit(EXIT_FAILURE);
       }
     } else if (strcmp(argv[i], "-c") == 0) {
-      if (i < argc - 1) {
-        strcpy(configDir, argv[++i]);
+      if (i < argc - 1) { 
+        if (strlen(argv[++i]) > TSDB_FILENAME_LEN - 1) {
+          fprintf(stderr, "config file path: %s overflow max len %d\n", argv[i], TSDB_FILENAME_LEN - 1);
+          exit(EXIT_FAILURE);
+        }
+        strcpy(configDir, argv[i]);
       } else {
         fprintf(stderr, "Option -c requires an argument\n");
         exit(EXIT_FAILURE);
diff --git a/src/kit/shell/src/shellLinux.c b/src/kit/shell/src/shellLinux.c
index b4b74eae3a..7d035126c0 100644
--- a/src/kit/shell/src/shellLinux.c
+++ b/src/kit/shell/src/shellLinux.c
@@ -80,6 +80,11 @@ static error_t parse_opt(int key, char *arg, struct argp_state *state) {
       if (wordexp(arg, &full_path, 0) != 0) {
         fprintf(stderr, "Invalid path %s\n", arg);
         return -1;
+      }       
+      if (strlen(full_path.we_wordv[0]) > TSDB_FILENAME_LEN - 1) {
+        fprintf(stderr, "config file path: %s overflow max len %d\n", full_path.we_wordv[0], TSDB_FILENAME_LEN - 1);
+        wordfree(&full_path);
+        return -1;
       }
       strcpy(configDir, full_path.we_wordv[0]);
       wordfree(&full_path);
diff --git a/src/kit/shell/src/shellWindows.c b/src/kit/shell/src/shellWindows.c
index 48545f537e..cf96bce5a8 100644
--- a/src/kit/shell/src/shellWindows.c
+++ b/src/kit/shell/src/shellWindows.c
@@ -76,8 +76,12 @@ void shellParseArgument(int argc, char *argv[], struct arguments *arguments) {
         exit(EXIT_FAILURE);
       }
     } else if (strcmp(argv[i], "-c") == 0) {
-      if (i < argc - 1) {
-        strcpy(configDir, argv[++i]);
+      if (i < argc - 1) {   
+        if (strlen(argv[++i]) > TSDB_FILENAME_LEN - 1) {
+          fprintf(stderr, "config file path: %s overflow max len %d\n", argv[i], TSDB_FILENAME_LEN - 1);
+          exit(EXIT_FAILURE);
+        }
+        strcpy(configDir, argv[i]);
       } else {
         fprintf(stderr, "Option -c requires an argument\n");
         exit(EXIT_FAILURE);
diff --git a/src/plugins/http/src/tgHandle.c b/src/plugins/http/src/tgHandle.c
index 1a55c325d5..61f9da6368 100644
--- a/src/plugins/http/src/tgHandle.c
+++ b/src/plugins/http/src/tgHandle.c
@@ -281,7 +281,7 @@ int tgReadSchema(char *fileName) {
 }
 
 void tgInitHandle(HttpServer *pServer) {
-  char fileName[256] = {0};
+  char fileName[TSDB_FILENAME_LEN*2] = {0};
   sprintf(fileName, "%s/taos.telegraf.cfg", configDir);
   if (tgReadSchema(fileName) <= 0) {
     tgFreeSchemas();
diff --git a/src/util/src/tconfig.c b/src/util/src/tconfig.c
index 32a3df844c..203a34fd15 100644
--- a/src/util/src/tconfig.c
+++ b/src/util/src/tconfig.c
@@ -241,7 +241,12 @@ void taosReadGlobalLogCfg() {
 
   wordexp_t full_path;
   wordexp(configDir, &full_path, 0);
-  if (full_path.we_wordv != NULL && full_path.we_wordv[0] != NULL) {
+  if (full_path.we_wordv != NULL && full_path.we_wordv[0] != NULL) {    
+    if (strlen(full_path.we_wordv[0]) > TSDB_FILENAME_LEN - 1) {
+      printf("\nconfig file: %s path overflow max len %d, all variables are set to default\n", full_path.we_wordv[0], TSDB_FILENAME_LEN - 1);
+      wordfree(&full_path);
+      return;
+    }
     strcpy(configDir, full_path.we_wordv[0]);
   } else {
     printf("configDir:%s not there, use default value: /etc/taos", configDir);
-- 
GitLab