[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
lib/44132: libc/rpc may overwrite not-allocated memory
>Synopsis: libc/rpc may overwrite not-allocated memory
>Arrival-Date: Tue Nov 23 09:35:00 +0000 2010
>Originator: Wolfgang Stukenbrock
>Release: NetBSD 5.0.2
Dr. Nagler & Company GmbH
System: NetBSD test-s1 5.0.2 NetBSD 5.0.2 (NSW-S011) #12: Thu Nov 11 11:29:19
In /usr/src/lib/libc/rpc/xdr_rec.c there is a routine called
realloc_stream(), that is used
to adjust the recieve buffer if the next record does not fit into the
This routine returns TRUE on success and FALSE on error.
This routine is used only by __xdrrec_getrec() in the same file, but
the return value is ignored.
So in the (very rare) case, that the realloc does not succeed, the
resulting buffer is to small.
Next the readit() function-pointer is called for the "rest of the
packet" and in the TCP-case
(read_vc() from clnt_vc.c) this routine will fill the buffer as
But the buffer is smaller and memory curruption occurs.
remark: I haven't added line numbers, because realloc_stream() is a
static routine and only called
once and it should be possible to locate it in the source file.
Problem found by a look into the sources.
Return an error if realloc() fails.
I'm not realy confirmed with the internals of the rpc-lib.
So I do not know what kind of error should be returned from
__xdrrec_getrec() in that case.
The routine should return FALSE if realloc_stream() failed, but I'm not
shure about the
correct value for *statp.
Main Index |
Thread Index |