[torquedev] patch: qsub out of memory

[Marcus R. Epperson]

Recently some of our resource_list lines have been too long for qsub (2.0.0p7) to handle.  The error we see looks like this:

# qsub test.pbs
qsub: out of memory

The problem shows up in qsub.c line 585.  'len' is assigned a negative number and the subsequent malloc(len+1) call fails.  The root cause seems to be that buffer[] overflows and corrupts the 'c' pointer which is used to calculate len.

The attached patch fixes the problem by dynamically sizing buffer[] to the size of line.  I think this is the "worst case" as far as the size requirement for buffer[] goes, so it should eliminate the chance of overflow.  I also added some assert statements to catch any more len <= 0 conditions, just in case. (better than calling malloc with a bogus value I think)

It has worked for all of my test cases so far, but I haven't tested extensively.

-Marcus
-------------- next part --------------
--- src/cmds/qsub.c-orig	2006-01-27 11:42:08.000000000 -0700
+++ src/cmds/qsub.c	2006-03-10 20:16:48.480976000 -0700
@@ -105,6 +105,8 @@
 #include <signal.h>
 #include <termios.h>
 #include <unistd.h>
+#include <stdlib.h>
+#include <assert.h>
 
 #ifdef sun
 #include <sys/stream.h>
@@ -504,11 +506,19 @@ void make_argv(
   char *line)
 
   {
-  char *l, *b, *c;
-  char buffer[4096];
+  char *l, *b, *c, *buffer;
   int len;
   char quote;
 
+  buffer = malloc(strlen(line) + 1);
+
+  if (buffer == NULL)
+    {
+    fprintf(stderr, "qsub: out of memory\n");
+
+    exit(2);
+    }
+
   *argc = 0;
 
   argv[(*argc)++] = "qsub";
@@ -551,6 +561,8 @@ void make_argv(
       {
       len = c - l;
 
+      assert(len > 0);
+
       if (argv[*argc] != NULL) 
         free(argv[*argc]);
 
@@ -584,6 +596,8 @@ void make_argv(
     {
     len = c - l;
 
+    assert(len > 0);
+
     if (argv[*argc] != NULL) 
       free(argv[*argc]);
 
@@ -600,6 +614,8 @@ void make_argv(
     strcpy(argv[(*argc)++],buffer);
     }
 
+  free(buffer);
+
   return;
   }  /* END make_argv() */