Merge branch 'develop' into firewall

client/maxadmin.c

@@ -184,7 +184,8 @@ char            c;
 	  }
 
 	  cmd = malloc(len);
-	  strcpy(cmd, argv[optind]);
+	  int arglen;
+	  memcpy(cmd, argv[optind], (arglen = strlen(argv[optind])) < 8192 ? arglen : 8192);
 	  for (i = optind +1; i < argc; i++) {
 	    strcat(cmd, " ");
 	    strcat(cmd, argv[i]);
@@ -317,6 +318,7 @@ int			keepalive = 1;
 	{
 		fprintf(stderr, "Unable to connect to MaxScale at %s, %s: %s\n",
 				hostname, port, strerror(errno));
+		close(so);
 		return -1;
 	}
 	if (setsockopt(so, SOL_SOCKET,

log_manager/test/testorder.c

@@ -78,7 +78,12 @@ int main(int argc, char** argv)
   for(i = 0;i<iterations;i++){
 
     sprintf(message,"message|%ld",msg_index++);
-    memset(message + strlen(message),' ',block_size - strlen(message));
+	int msgsize = block_size - strlen(message);
+	if(msgsize < 0 || msgsize > 8192){
+		fprintf(stderr,"Error: Message too long");
+		break;
+	}
+    memset(message + strlen(message), ' ', msgsize);
     memset(message + block_size - 1,'\0',1);
     if(interval > 0 && i % interval == 0){
       err = skygw_log_write_flush(LOGFILE_ERROR, message);
@@ -90,7 +95,6 @@ int main(int argc, char** argv)
       break;
     }
     usleep(100);
-    //printf("%s\n",message);
   }
 
   skygw_log_flush(LOGFILE_ERROR);

query_classifier/query_classifier.cc

@@ -1049,10 +1049,11 @@ char** skygw_get_table_names(GWBUF* querybuf,int* tblsize, bool fullnames)
   TABLE_LIST*		tbl;
   int			i = 0,
 			currtblsz = 0;
-  char			**tables,
+  char			**tables = NULL,
-			**tmp;
+			**tmp = NULL;
 
-  if((lex = get_lex(querybuf)) == NULL)
+  if( (lex = get_lex(querybuf)) == NULL || 
+	  lex->current_select == NULL )
 	{
       goto retblock;
     }        

query_classifier/test/canonical_tests/canonizer.c

@@ -62,7 +62,7 @@ int main(int argc, char** argv)
 			*(qbuff->sbuf->data + 1) = (unsigned char)(psize>>8);
 			*(qbuff->sbuf->data + 2) = (unsigned char)(psize>>16);
 			*(qbuff->sbuf->data + 4) = 0x03;
-			strcpy((char*)(qbuff->start + 5),readbuff);
+			memcpy(qbuff->start + 5,readbuff,psize + 1);
 			parse_query(qbuff);
 			tok = skygw_get_canonical(qbuff);
 			fprintf(outfile,"%s\n",tok);

query_classifier/test/classify.c

@@ -45,8 +45,8 @@ int main(int argc, char** argv)
 
 	input = fopen(argv[1],"rb");
 	expected = fopen(argv[2],"rb");
-
+	memset(buffer,0,buffsz);
-	while((rd = fread(buffer,sizeof(char),buffsz,input))){
+	while((rd = fread(buffer,sizeof(char),buffsz - 1,input))){
 		
 		/**Fill the read buffer*/
 		if(strsz + rd >= buffsz){
@@ -167,7 +167,7 @@ int main(int argc, char** argv)
 			
 			gwbuf_free(buff);			
 		}
-
+			memset(buffer,0,buffsz);
 	}
 	fclose(input);
 	fclose(expected);

server/core/adminusers.c

@@ -116,10 +116,12 @@ char	fname[1024], *home;
 char	uname[80], passwd[80];
 
 	initialise();
-	if ((home = getenv("MAXSCALE_HOME")) != NULL)
+	if ((home = getenv("MAXSCALE_HOME")) != NULL && strlen(home) < 1024){
 		sprintf(fname, "%s/etc/passwd", home);
-	else
+	}
+	else{
 		sprintf(fname, "/usr/local/skysql/MaxScale/etc/passwd");
+	}
 	if ((fp = fopen(fname, "r")) == NULL)
 		return NULL;
 	if ((rval = users_alloc()) == NULL)
@@ -150,10 +152,12 @@ FILE	*fp;
 char	fname[1024], *home, *cpasswd;
 
 	initialise();
-	if ((home = getenv("MAXSCALE_HOME")) != NULL)
+	if ((home = getenv("MAXSCALE_HOME")) != NULL && strlen(home) < 1024){
 		sprintf(fname, "%s/etc/passwd", home);
-	else
+	}
+	else{
 		sprintf(fname, "/usr/local/skysql/MaxScale/etc/passwd");
+	}
         
 	if (users == NULL)
 	{
@@ -246,7 +250,7 @@ char* admin_remove_user(
         /**
          * Open passwd file and remove user from the file.
          */
-        if ((home = getenv("MAXSCALE_HOME")) != NULL) {
+        if ((home = getenv("MAXSCALE_HOME")) != NULL && strlen(home) < 1024) {
                 sprintf(fname, "%s/etc/passwd", home);
                 sprintf(fname_tmp, "%s/etc/passwd_tmp", home);
         } else {
@@ -310,7 +314,12 @@ char* admin_remove_user(
                  * Unmatching lines are copied to tmp file.
                  */
                 if (strncmp(uname, fusr, strlen(uname)+1) != 0) {
-                        fsetpos(fp, &rpos); /** one step back */ 
+					if(fsetpos(fp, &rpos) != 0){ /** one step back */ 
+                        LOGIF(LE, (skygw_log_write_flush(
+                                LOGFILE_ERROR,
+                                "Error : Unable to set stream position. ")));
+
+					}
                         fgets(line, LINELEN, fp);
                         fputs(line, fp_tmp);
                 }

server/core/buffer.c

@@ -517,9 +517,11 @@ void* gwbuf_get_buffer_object_data(
         }
         /** Unlock */
         spinlock_release(&buf->gwbuf_lock);
-        
+		if(bo){
 			return bo->bo_data;
 		}
+		return NULL;
+}
 
 /**
  * @return pointer to next buffer object or NULL

server/core/config.c

@@ -461,6 +461,7 @@ int			error_count = 0;
 						
 						if (!succp)
 						{
+							if(param){
 							LOGIF(LM, (skygw_log_write(
 								LOGFILE_MESSAGE,
 								"* Warning : invalid value type "
@@ -470,6 +471,12 @@ int			error_count = 0;
 								((SERVICE*)obj->element)->name,
 								param->name,
 								param->value)));
+							}else{
+								LOGIF(LE, (skygw_log_write(
+								LOGFILE_ERROR,
+								"Error : parameter was NULL")));
+							
+							}
 						}
 					}
 				} /*< if (rw_split) */
@@ -1306,6 +1313,7 @@ SERVER			*server;
 							
                                                         if (!succp)
                                                         {
+															if(param){
                                                                 LOGIF(LM, (skygw_log_write(
                                                                         LOGFILE_MESSAGE,
                                                                         "* Warning : invalid value type "
@@ -1315,6 +1323,11 @@ SERVER			*server;
                                                                         ((SERVICE*)obj->element)->name,
                                                                         param->name,
                                                                         param->value)));                                                                
+															}else{
+                                                                LOGIF(LE, (skygw_log_write(
+                                                                        LOGFILE_ERROR,
+                                                                        "Error : parameter was NULL")));                                                                
+															}
                                                         }
                                                 }
 					}
@@ -1346,7 +1359,7 @@ SERVER			*server;
 						serviceSetUser(obj->element,
                                                                user,
                                                                auth);
-						if (enable_root_user)
+						if (enable_root_user && service)
 							serviceEnableRootUser(service, atoi(enable_root_user));
 
 						if (allow_localhost_match_wildcard_host)

server/core/dbusers.c

@@ -855,9 +855,6 @@ static int uh_cmpfun( void* v1, void* v2) {
 	if (v1 == NULL || v2 == NULL)
 		return 0;
 	
-	if (hu1 == NULL || hu2 == NULL)
-		return 0;
-
 	if (hu1->user == NULL || hu2->user == NULL)
 		return 0;
 
@@ -961,9 +958,6 @@ char *mysql_format_user_entry(void *data)
 	
         entry = (MYSQL_USER_HOST *) data;
 
-	if (entry == NULL)
-		return NULL;
-
 	mysql_user = (char *) calloc(mysql_user_len, sizeof(char));
 
 	if (mysql_user == NULL)

server/core/dcb.c

@@ -1155,10 +1155,9 @@ dcb_close(DCB *dcb)
 		} else {
 			LOGIF(LE, (skygw_log_write(
 				LOGFILE_ERROR,
-				"%lu [dcb_close] Error : Removing dcb %p in state %s from "
+				"Error : Removing DCB fd == %d in state %s from "
 				"poll set failed.",
-				pthread_self(),
+				dcb->fd,
-				dcb,
 				STRDCBSTATE(dcb->state))));
 		}
 		
@@ -1670,7 +1669,7 @@ static bool dcb_set_state_nomutex(
                                    "Old state %s > new state %s.",
                                    pthread_self(),
                                    dcb,
-                                   STRDCBSTATE(*old_state),
+				   (old_state == NULL ? "NULL" : STRDCBSTATE(*old_state)),
                                    STRDCBSTATE(new_state))));
         }
         return succp;

server/core/gateway.c

@@ -479,6 +479,11 @@ static bool resolve_maxscale_conf_fname(
                                  goto return_succp;
                          }                        
                 }
+                else 
+		{
+			/** Allocate memory for use of realpath */
+			*cnf_full_path = (char *)malloc(PATH_MAX+1);
+		}
                 /*<
                  * 3. argument is valid relative pathname
                  * '-f ../myconf.cnf'
@@ -1521,7 +1526,12 @@ int main(int argc, char **argv)
          * machine.
          */
         sprintf(datadir, "%s/data%d", home_dir, getpid());
-        mkdir(datadir, 0777);
+        if(mkdir(datadir, 0777) != 0){
+			LOGIF(LE,(skygw_log_write_flush(
+										 LOGFILE_ERROR,
+										 "Error : Directory creation failed due to %s.", 
+										 strerror(errno))));		
+		}
 
         if (!daemon_mode)
         {
@@ -1700,10 +1710,6 @@ int main(int argc, char **argv)
         {
                 thread_wait(threads[n]);
         }        
-        free(threads);
-        free(home_dir);
-        free(cnf_file_path);
-        
         /*<
          * Wait the flush thread.
          */
@@ -1727,6 +1733,10 @@ int main(int argc, char **argv)
 	unlink_pidfile();
 	
 return_main:
+	free(threads);
+	free(home_dir);
+	free(cnf_file_path);
+
         return rc;
 } /*< End of main */
 

server/core/gwbitmask.c

@@ -121,7 +121,7 @@ unsigned	char mask;
 	{
 		bitmask->bits = realloc(bitmask->bits,
 			(bitmask->length + BIT_LENGTH_INC) / 8);
-		memset(bitmask + (bitmask->length / 8), 0,
+		memset(bitmask->bits + (bitmask->length / 8), 0,
 			BIT_LENGTH_INC / 8);
 		bitmask->length += (BIT_LENGTH_INC / 8);
 	}
@@ -150,7 +150,7 @@ unsigned	char mask;
 	{
 		bitmask->bits = realloc(bitmask->bits,
 			(bitmask->length + BIT_LENGTH_INC) / 8);
-		memset(bitmask + (bitmask->length / 8), 0,
+		memset(bitmask->bits + (bitmask->length / 8), 0,
 			BIT_LENGTH_INC / 8);
 		bitmask->length += (BIT_LENGTH_INC / 8);
 	}

server/modules/filter/qlafilter.c

@@ -40,6 +40,7 @@
  */
 #include <stdio.h>
 #include <fcntl.h>
+#include <errno.h>
 #include <filter.h>
 #include <modinfo.h>
 #include <modutil.h>
@@ -170,10 +171,11 @@ int		i;
 
 	if ((my_instance = calloc(1, sizeof(QLA_INSTANCE))) != NULL)
 	{
-		if (options)
+		if (options){
 			my_instance->filebase = strdup(options[0]);
-		else
+		}else{
 			my_instance->filebase = strdup("qla");
+		}
 		my_instance->source = NULL;
 		my_instance->userName = NULL;
 		my_instance->match = NULL;
@@ -196,8 +198,10 @@ int		i;
 					my_instance->userName = strdup(params[i]->value);
 				else if (!strcmp(params[i]->name, "filebase"))
 				{
-					if (my_instance->filebase)
+					if (my_instance->filebase){
 						free(my_instance->filebase);
+						my_instance->filebase = NULL;
+					}
 					my_instance->source = strdup(params[i]->value);
 				}
 				else if (!filter_standard_parameter(params[i]->name))
@@ -219,7 +223,9 @@ int		i;
 					my_instance->match)));
 			free(my_instance->match);
 			free(my_instance->source);
+			if(my_instance->filebase){
 				free(my_instance->filebase);
+			}
 			free(my_instance);
 			return NULL;
 		}
@@ -235,7 +241,9 @@ int		i;
 				regfree(&my_instance->re);
 			free(my_instance->match);
 			free(my_instance->source);
+			if(my_instance->filebase){
 				free(my_instance->filebase);
+			}
 			free(my_instance);
 			return NULL;
 		}
@@ -265,10 +273,17 @@ char		*remote, *userName;
 			(char *)malloc(strlen(my_instance->filebase) + 20))
 						== NULL)
 		{
+			LOGIF(LE, (skygw_log_write(
+				LOGFILE_ERROR,
+			      "Error : Memory allocation for qla filter "
+			      "file name failed due to %d, %s.",
+			      errno,
+			      strerror(errno))));
 			free(my_session);
 			return NULL;
 		}
 		my_session->active = 1;
+		
 		if (my_instance->source 
 			&& (remote = session_get_remote(session)) != NULL)
 		{
@@ -276,16 +291,45 @@ char		*remote, *userName;
 				my_session->active = 0;
 		}
 		userName = session_getUser(session);
-		if (my_instance->userName && userName && strcmp(userName,
+		
-							my_instance->userName))
+		if (my_instance->userName && 
+			userName && 
+			strcmp(userName,my_instance->userName))
+		{
 			my_session->active = 0;
-		sprintf(my_session->filename, "%s.%d", my_instance->filebase,
+		}
+		sprintf(my_session->filename, "%s.%d", 
+			my_instance->filebase,
 			my_instance->sessions);
 		my_instance->sessions++;
-		if (my_session->active)
-			my_session->fp = fopen(my_session->filename, "w");
-	}
 		
+		if (my_session->active)
+		{
+			my_session->fp = fopen(my_session->filename, "w");
+			
+			if (my_session->fp == NULL)
+			{
+				LOGIF(LE, (skygw_log_write(
+					LOGFILE_ERROR,
+					"Error : Opening output file for qla "
+					"fileter failed due to %d, %s",
+					errno,
+					strerror(errno))));
+				free(my_session->filename);
+				free(my_session);
+				my_session = NULL;
+			}
+		}
+	}
+	else
+	{
+		LOGIF(LE, (skygw_log_write(
+			LOGFILE_ERROR,
+			"Error : Memory allocation for qla filter failed due to "
+			"%d, %s.",
+			errno,
+			strerror(errno))));
+	}
 	return my_session;
 }
 

server/modules/filter/tee.c

@@ -391,7 +391,7 @@ routeQuery(FILTER *instance, void *session, GWBUF *queue)
 TEE_INSTANCE	*my_instance = (TEE_INSTANCE *)instance;
 TEE_SESSION	*my_session = (TEE_SESSION *)session;
 char		*ptr;
-int		length, rval, residual;
+int		length, rval, residual = 0;
 GWBUF		*clone = NULL;
 
 	if (my_session->residual)

server/modules/protocol/maxscaled.c

@@ -270,6 +270,7 @@ int	n_connect = 0;
 			if (client_dcb == NULL)
 
 			{
+				close(so);
 				return n_connect;
 			}
                         client_dcb->fd = so;

server/modules/protocol/telnetd.c

@@ -298,6 +298,7 @@ int	n_connect = 0;
 			if (client_dcb == NULL)
 
 			{
+				close(so);
 				return n_connect;
 			}
                         client_dcb->fd = so;

server/modules/routing/readwritesplit/readwritesplit.c

@@ -1356,7 +1356,7 @@ static route_target_t get_route_target (
 			hint = hint->next;
 		} /*< while (hint != NULL) */
 		/** If nothing matches then choose the master */
-		if ((target & (TARGET_ALL|TARGET_SLAVE|TARGET_MASTER)) == target)
+		if ((target & (TARGET_ALL|TARGET_SLAVE|TARGET_MASTER)) == 0)
 		{
 			target = TARGET_MASTER;
 		}
@@ -1520,13 +1520,20 @@ skygw_query_type_t is_read_tmp_table(
 		}
 
 	      free(hkey);
-	      free(tbl[i]);
 	    }
 
-	  free(tbl); 
 	}
     }
 
+	if(tsize > 0)
+		{
+			for(i = 0; i<tsize;i++)
+				{
+					free(tbl[i]);
+				}
+			free(tbl); 
+		}
+
 	return qtype;
 }
 
@@ -2631,7 +2638,12 @@ static bool select_connect_backend_servers(
 	/* get the root Master */ 
 	master_host = get_root_master(backend_ref, router_nservers);
 
-        /** Master is already chosen and connected. This is slave failure case */
+        /** 
+	 * Master is already chosen and connected. It means that the function 
+	 * was called from error handling function or from some other similar
+	 * function where session was already established but new slaves needed 
+	 * to be selected.
+	 */
         if (*p_master_ref != NULL &&
                 BREF_IS_IN_USE((*p_master_ref)))
         {