bin/44514: Buffer underflow in RPC library for non-blocking TCP sockets

[Andrey Simonenko <simon%comsys.ntu-kpi.kiev.ua@localhost>]

>Number:         44514
>Category:       bin
>Synopsis:       Buffer underflow in RPC library for non-blocking TCP sockets
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Feb 04 15:55:00 +0000 2011
>Originator:     Andrey Simonenko
>Release:        NetBSD HEAD
>Organization:
>Environment:
>Description:

The libc/rpc/svc_vc.c:write_vc() function calls write() and sends data
to opened TCP connection.  For non-blocking socket it has something like
timeout in 2 seconds (actually write_vc() can spend more real time for
sending for non-blocking socket).  The i variable is used for offset in
a buffer and as a counter at the same time.  When write() fails this
variable got the -1 value and this value as added to the buffer address
and to the counter (the buffer address is decreased and the counter value
actually is increased).  So we get buffer underflow.

As a result write_vc() can send data that does not belong to data that
were expected to be sent, so this is a security mistake for any program
that use RPC with a non-blocking TCP socket.

>How-To-Repeat:

Run any RPC program that transfers big data over non-blocking TCP socket.
A client will receive truncated data or garbage data, or data that should
not be sent to a client (everything depends on how memory blocks were
allocated in a server).

>Fix:

I found this mistake on FreeBSD and verified correctness of my change
on that system.

This this the update (this is the minimal version, without optimization):

--- svc_vc.c.orig       2011-02-04 17:27:14.000000000 +0200
+++ svc_vc.c    2011-02-04 17:32:05.000000000 +0200
@@ -610,7 +610,7 @@ write_vc(xprtp, buf, len)
                                cd->strm_stat = XPRT_DIED;
                                return (-1);
                        }
-                       if (cd->nonblock && i != cnt) {
+                       if (cd->nonblock) {
                                /*
                                 * For non-blocking connections, do not
                                 * take more than 2 seconds writing the
@@ -624,6 +624,7 @@ write_vc(xprtp, buf, len)
                                        return (-1);
                                }
                        }
+                       i = 0;
                }
        }
        return (len);