diff mbox

clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)

Message ID 20180301170629.20780-1-steved@redhat.com (mailing list archive)
State New, archived
Headers show

Commit Message

Steve Dickson March 1, 2018, 5:06 p.m. UTC 
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1337142
Signed-off-by: Steve Dickson <steved@redhat.com>
---
 src/clnt_dg.c | 7 +++++++
 1 file changed, 7 insertions(+)

Comments

Steve Dickson March 2, 2018, 3:46 p.m. UTC | #1 
On 03/01/2018 12:06 PM, Steve Dickson wrote:
> Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1337142
> Signed-off-by: Steve Dickson <steved@redhat.com>
Committed... 

steved.
> ---
>  src/clnt_dg.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/src/clnt_dg.c b/src/clnt_dg.c
> index 248138b..884a2db 100644
> --- a/src/clnt_dg.c
> +++ b/src/clnt_dg.c
> @@ -433,6 +433,11 @@ get_reply:
>  	  char *cbuf = (char *) alloca (outlen + 256);
>  	  int ret;
>  
> +	  if (cbuf == NULL) 
> +	  {
> +	  	cu->cu_error.re_errno = errno;
> +		return (cu->cu_error.re_status = RPC_CANTRECV);
> +	  }
>  	  iov.iov_base = cbuf + 256;
>  	  iov.iov_len = outlen;
>  	  msg.msg_name = (void *) &err_addr;
> @@ -457,11 +462,13 @@ get_reply:
>  		 cmsg = CMSG_NXTHDR (&msg, cmsg))
>  	      if (cmsg->cmsg_level == SOL_IP && cmsg->cmsg_type == IP_RECVERR)
>  		{
> +		  free(cbuf);
>  		  e = (struct sock_extended_err *) CMSG_DATA(cmsg);
>  		  cu->cu_error.re_errno = e->ee_errno;
>  		  release_fd_lock(cu->cu_fd, mask);
>  		  return (cu->cu_error.re_status = RPC_CANTRECV);
>  		}
> +	  free(cbuf);
>  	}
>  #endif
>  
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/src/clnt_dg.c b/src/clnt_dg.c
index 248138b..884a2db 100644
--- a/src/clnt_dg.c
+++ b/src/clnt_dg.c
@@ -433,6 +433,11 @@  get_reply:
 	  char *cbuf = (char *) alloca (outlen + 256);
 	  int ret;
 
+	  if (cbuf == NULL) 
+	  {
+	  	cu->cu_error.re_errno = errno;
+		return (cu->cu_error.re_status = RPC_CANTRECV);
+	  }
 	  iov.iov_base = cbuf + 256;
 	  iov.iov_len = outlen;
 	  msg.msg_name = (void *) &err_addr;
@@ -457,11 +462,13 @@  get_reply:
 		 cmsg = CMSG_NXTHDR (&msg, cmsg))
 	      if (cmsg->cmsg_level == SOL_IP && cmsg->cmsg_type == IP_RECVERR)
 		{
+		  free(cbuf);
 		  e = (struct sock_extended_err *) CMSG_DATA(cmsg);
 		  cu->cu_error.re_errno = e->ee_errno;
 		  release_fd_lock(cu->cu_fd, mask);
 		  return (cu->cu_error.re_status = RPC_CANTRECV);
 		}
+	  free(cbuf);
 	}
 #endif