Re: [PATCH] clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




On 03/01/2018 12:06 PM, Steve Dickson wrote:
> Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1337142
> Signed-off-by: Steve Dickson <steved@xxxxxxxxxx>
Committed... 

steved.
> ---
>  src/clnt_dg.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/src/clnt_dg.c b/src/clnt_dg.c
> index 248138b..884a2db 100644
> --- a/src/clnt_dg.c
> +++ b/src/clnt_dg.c
> @@ -433,6 +433,11 @@ get_reply:
>  	  char *cbuf = (char *) alloca (outlen + 256);
>  	  int ret;
>  
> +	  if (cbuf == NULL) 
> +	  {
> +	  	cu->cu_error.re_errno = errno;
> +		return (cu->cu_error.re_status = RPC_CANTRECV);
> +	  }
>  	  iov.iov_base = cbuf + 256;
>  	  iov.iov_len = outlen;
>  	  msg.msg_name = (void *) &err_addr;
> @@ -457,11 +462,13 @@ get_reply:
>  		 cmsg = CMSG_NXTHDR (&msg, cmsg))
>  	      if (cmsg->cmsg_level == SOL_IP && cmsg->cmsg_type == IP_RECVERR)
>  		{
> +		  free(cbuf);
>  		  e = (struct sock_extended_err *) CMSG_DATA(cmsg);
>  		  cu->cu_error.re_errno = e->ee_errno;
>  		  release_fd_lock(cu->cu_fd, mask);
>  		  return (cu->cu_error.re_status = RPC_CANTRECV);
>  		}
> +	  free(cbuf);
>  	}
>  #endif
>  
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux Filesystem Development]     [Linux USB Development]     [Linux Media Development]     [Video for Linux]     [Linux NILFS]     [Linux Audio Users]     [Yosemite Info]     [Linux SCSI]

  Powered by Linux