Check for truncation in more places

diff --git a/src/main/xlat.c b/src/main/xlat.c
index f170f87..2e9ede4 100644 (file)
--- a/src/main/xlat.c
+++ b/src/main/xlat.c
@@ -374,6 +374,7 @@ static ssize_t xlat_foreach(void *instance, REQUEST *request,
                            UNUSED char const *fmt, char *out, size_t outlen)
 {
        VALUE_PAIR      **pvp;
+       size_t          len;
 
        /*
         *      See modcall, "FOREACH" for how this works.
@@ -384,7 +385,13 @@ static ssize_t xlat_foreach(void *instance, REQUEST *request,
                return 0;
        }
 
-       return vp_prints_value(out, outlen, *pvp, 0);
+       len = vp_prints_value(out, outlen, *pvp, 0);
+       if (is_truncated(len, outlen)) {
+               RDEBUG("Insufficient buffer space to write foreach value");
+               return -1;
+       }
+
+       return len;
 }
 #endif
 

diff --git a/src/modules/rlm_cache/rlm_cache.c b/src/modules/rlm_cache/rlm_cache.c
index 30b9b80..0d43b52 100644 (file)
--- a/src/modules/rlm_cache/rlm_cache.c
+++ b/src/modules/rlm_cache/rlm_cache.c
@@ -660,13 +660,14 @@ static int cache_verify(rlm_cache_t *inst, value_pair_map_t **head)
 static ssize_t cache_xlat(void *instance, REQUEST *request,
                          char const *fmt, char *out, size_t freespace)
 {
-       rlm_cache_entry_t *c;
-       rlm_cache_t *inst = instance;
-       VALUE_PAIR *vp, *vps;
-       pair_lists_t list;
-       DICT_ATTR const *target;
-       char const *p = fmt;
-       int ret = 0;
+       rlm_cache_entry_t       *c;
+       rlm_cache_t             *inst = instance;
+       VALUE_PAIR              *vp, *vps;
+       pair_lists_t            list;
+       DICT_ATTR const         *target;
+       char const              *p = fmt;
+       size_t                  len;
+       int                     ret = 0;
 
        list = radius_list_name(&p, PAIR_LIST_REQUEST);
 
@@ -717,7 +718,12 @@ static ssize_t cache_xlat(void *instance, REQUEST *request,
                goto done;
        }
 
-       ret = vp_prints_value(out, freespace, vp, 0);
+       len = vp_prints_value(out, freespace, vp, 0);
+       if (is_truncated(len, freespace)) {
+               PTHREAD_MUTEX_UNLOCK(&inst->cache_mutex);
+               REDEBUG("Insufficient buffer space to write cached value");
+               return -1;
+       }
 done:
        PTHREAD_MUTEX_UNLOCK(&inst->cache_mutex);
 

diff --git a/src/modules/rlm_unpack/rlm_unpack.c b/src/modules/rlm_unpack/rlm_unpack.c
index 650209d..302a721 100644 (file)
--- a/src/modules/rlm_unpack/rlm_unpack.c
+++ b/src/modules/rlm_unpack/rlm_unpack.c
@@ -178,6 +178,10 @@ static ssize_t unpack_xlat(UNUSED void *instance, REQUEST *request, char const *
        }
 
        len = vp_prints_value(out, outlen, cast, 0);
+       if (is_truncated(len, outlen)) {
+               REDEBUG("Insufficient buffer space to unpack data");
+               goto nothing;
+       }
        talloc_free(cast);
 
        return len;