diff options
| author | Xin LI <delphij@FreeBSD.org> | 2017-06-01 06:12:25 +0000 |
|---|---|---|
| committer | Xin LI <delphij@FreeBSD.org> | 2017-06-01 06:12:25 +0000 |
| commit | 6448ec89e7391aee8ce76785e0ec520ba7abb1c8 (patch) | |
| tree | b46740f9ea572cd854ee87389eef91802c3ffae6 /lib/libc/xdr | |
| parent | 26f923dca39acab33709d5073558846f0e1b67ae (diff) | |
* limit size of buffers to RPC_MAXDATASIZE
* don't leak memory
* be more picky about bad parameters
From:
https://raw.githubusercontent.com/guidovranken/rpcbomb/master/libtirpc_patch.txt
https://github.com/guidovranken/rpcbomb/blob/master/rpcbind_patch.txt
via NetBSD.
Reviewed by: emaste, cem (earlier version)
Differential Revision: https://reviews.freebsd.org/D10922
MFC after: 3 days
Notes
Notes:
svn path=/head/; revision=319369
Diffstat (limited to 'lib/libc/xdr')
| -rw-r--r-- | lib/libc/xdr/xdr.c | 30 |
1 files changed, 25 insertions, 5 deletions
diff --git a/lib/libc/xdr/xdr.c b/lib/libc/xdr/xdr.c index 4138171e5023..2d99f58d81bf 100644 --- a/lib/libc/xdr/xdr.c +++ b/lib/libc/xdr/xdr.c @@ -52,6 +52,8 @@ __FBSDID("$FreeBSD$"); #include <stdlib.h> #include <string.h> +#include <rpc/rpc.h> +#include <rpc/rpc_com.h> #include <rpc/types.h> #include <rpc/xdr.h> #include "un-namespace.h" @@ -64,7 +66,6 @@ typedef u_quad_t u_longlong_t; /* ANSI unsigned long long type */ */ #define XDR_FALSE ((long) 0) #define XDR_TRUE ((long) 1) -#define LASTUNSIGNED ((u_int) 0-1) /* * for unit alignment @@ -561,6 +562,7 @@ xdr_bytes(XDR *xdrs, char **cpp, u_int *sizep, u_int maxsize) { char *sp = *cpp; /* sp is the actual string pointer */ u_int nodesize; + bool_t ret, allocated = FALSE; /* * first deal with the length since xdr bytes are counted @@ -584,6 +586,7 @@ xdr_bytes(XDR *xdrs, char **cpp, u_int *sizep, u_int maxsize) } if (sp == NULL) { *cpp = sp = mem_alloc(nodesize); + allocated = TRUE; } if (sp == NULL) { warnx("xdr_bytes: out of memory"); @@ -592,7 +595,14 @@ xdr_bytes(XDR *xdrs, char **cpp, u_int *sizep, u_int maxsize) /* FALLTHROUGH */ case XDR_ENCODE: - return (xdr_opaque(xdrs, sp, nodesize)); + ret = xdr_opaque(xdrs, sp, nodesize); + if ((xdrs->x_op == XDR_DECODE) && (ret == FALSE)) { + if (allocated == TRUE) { + free(sp); + *cpp = NULL; + } + } + return (ret); case XDR_FREE: if (sp != NULL) { @@ -683,6 +693,7 @@ xdr_string(XDR *xdrs, char **cpp, u_int maxsize) char *sp = *cpp; /* sp is the actual string pointer */ u_int size; u_int nodesize; + bool_t ret, allocated = FALSE; /* * first deal with the length since xdr strings are counted-strings @@ -716,8 +727,10 @@ xdr_string(XDR *xdrs, char **cpp, u_int maxsize) if (nodesize == 0) { return (TRUE); } - if (sp == NULL) + if (sp == NULL) { *cpp = sp = mem_alloc(nodesize); + allocated = TRUE; + } if (sp == NULL) { warnx("xdr_string: out of memory"); return (FALSE); @@ -726,7 +739,14 @@ xdr_string(XDR *xdrs, char **cpp, u_int maxsize) /* FALLTHROUGH */ case XDR_ENCODE: - return (xdr_opaque(xdrs, sp, size)); + ret = xdr_opaque(xdrs, sp, size); + if ((xdrs->x_op == XDR_DECODE) && (ret == FALSE)) { + if (allocated == TRUE) { + free(sp); + *cpp = NULL; + } + } + return (ret); case XDR_FREE: mem_free(sp, nodesize); @@ -744,7 +764,7 @@ xdr_string(XDR *xdrs, char **cpp, u_int maxsize) bool_t xdr_wrapstring(XDR *xdrs, char **cpp) { - return xdr_string(xdrs, cpp, LASTUNSIGNED); + return xdr_string(xdrs, cpp, RPC_MAXDATASIZE); } /* |