Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Security flaw in SunRPC XDR libraries

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Jon Svendsen <jon-sven AT frisurf.no>
  • To: Jonathan Evraire <evraire AT tuwg.com>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Security flaw in SunRPC XDR libraries
  • Date: 06 Aug 2002 22:41:43 +0200

On Tue, 2002-08-06 at 19:32, Jonathan Evraire wrote:
> Are we affected?

Yes we are.

> Can we easily become unaffected by patching the
> affected libraries and recompiling everything?

The appropriate fix will be to apply the attatched patch to glibc, and
recompile it. It's unlikely that anything else should need to be
recompiled, unless the sunrpc code is used in any statically linked
binaries, which i doubt.
===================================================================
RCS file: /cvs/glibc/libc/sunrpc/xdr_array.c,v
retrieving revision 1.5
retrieving revision 1.5.2.1
diff -u -r1.5 -r1.5.2.1
--- libc/sunrpc/xdr_array.c 2001/08/17 04:48:31 1.5
+++ libc/sunrpc/xdr_array.c 2002/08/02 01:35:39 1.5.2.1
@@ -45,6 +45,7 @@
#include <rpc/types.h>
#include <rpc/xdr.h>
#include <libintl.h>
+#include <limits.h>

#ifdef USE_IN_LIBIO
# include <wchar.h>
@@ -81,7 +82,11 @@
return FALSE;
}
c = *sizep;
- if ((c > maxsize) && (xdrs->x_op != XDR_FREE))
+ /*
+ * XXX: Let the overflow possibly happen with XDR_FREE because mem_free()
+ * doesn't actually use its second argument anyway.
+ */
+ if ((c > maxsize || c > UINT_MAX / elsize) && (xdrs->x_op != XDR_FREE))
{
return FALSE;
}



Archive powered by MHonArc 2.6.24.

Top of Page