You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

69 lines
2.0 KiB

  1. From 0bc1c0ae7ce61a7ac8a8e9a9b2086268f011abf0 Mon Sep 17 00:00:00 2001
  2. From: Steve Dickson <steved@redhat.com>
  3. Date: Tue, 9 Oct 2018 09:19:50 -0400
  4. Subject: [PATCH 1/1] rpcinfo: Fix stack buffer overflow
  5. *** buffer overflow detected ***: rpcinfo terminated
  6. ======= Backtrace: =========
  7. /lib64/libc.so.6(+0x721af)[0x7ff24c4451af]
  8. /lib64/libc.so.6(__fortify_fail+0x37)[0x7ff24c4ccdc7]
  9. /lib64/libc.so.6(+0xf8050)[0x7ff24c4cb050]
  10. rpcinfo(+0x435f)[0xef3be2635f]
  11. rpcinfo(+0x1c62)[0xef3be23c62]
  12. /lib64/libc.so.6(__libc_start_main+0xf5)[0x7ff24c3f36e5]
  13. rpcinfo(+0x2739)[0xef3be24739]
  14. ======= Memory map: ========
  15. ...
  16. The patch below fixes it.
  17. Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
  18. Signed-off-by: Thomas Blume <thomas.blume@suse.com>
  19. Signed-off-by: Steve Dickson <steved@redhat.com>
  20. ---
  21. src/rpcinfo.c | 23 +++++++++++++++++------
  22. 1 file changed, 17 insertions(+), 6 deletions(-)
  23. diff --git a/src/rpcinfo.c b/src/rpcinfo.c
  24. index 9b46864..cfdba88 100644
  25. --- a/src/rpcinfo.c
  26. +++ b/src/rpcinfo.c
  27. @@ -973,6 +973,7 @@ rpcbdump (dumptype, netid, argc, argv)
  28. (" program version(s) netid(s) service owner\n");
  29. for (rs = rs_head; rs; rs = rs->next)
  30. {
  31. + size_t netidmax = sizeof(buf) - 1;
  32. char *p = buf;
  33. printf ("%10ld ", rs->prog);
  34. @@ -985,12 +986,22 @@ rpcbdump (dumptype, netid, argc, argv)
  35. }
  36. printf ("%-10s", buf);
  37. buf[0] = '\0';
  38. - for (nl = rs->nlist; nl; nl = nl->next)
  39. - {
  40. - strcat (buf, nl->netid);
  41. - if (nl->next)
  42. - strcat (buf, ",");
  43. - }
  44. +
  45. + for (nl = rs->nlist; nl; nl = nl->next)
  46. + {
  47. + strncat (buf, nl->netid, netidmax);
  48. + if (strlen (nl->netid) < netidmax)
  49. + netidmax -= strlen(nl->netid);
  50. + else
  51. + break;
  52. +
  53. + if (nl->next && netidmax > 1)
  54. + {
  55. + strncat (buf, ",", netidmax);
  56. + netidmax --;
  57. + }
  58. + }
  59. +
  60. printf ("%-32s", buf);
  61. rpc = getrpcbynumber (rs->prog);
  62. if (rpc)
  63. --
  64. 1.8.3.1