Public SourceMage Discussion List

[Jon Svendsen <jon-sven AT frisurf.no>]

On Tue, 2002-08-06 at 19:32, Jonathan Evraire wrote:
> Are we affected?

Yes we are.

> Can we easily become unaffected by patching the
> affected libraries and recompiling everything?

The appropriate fix will be to apply the attatched patch to glibc, and
recompile it. It's unlikely that anything else should need to be
recompiled, unless the sunrpc code is used in any statically linked
binaries, which i doubt.
===================================================================
RCS file: /cvs/glibc/libc/sunrpc/xdr_array.c,v
retrieving revision 1.5
retrieving revision 1.5.2.1
diff -u -r1.5 -r1.5.2.1
--- libc/sunrpc/xdr_array.c     2001/08/17 04:48:31     1.5
+++ libc/sunrpc/xdr_array.c     2002/08/02 01:35:39     1.5.2.1
@@ -45,6 +45,7 @@
 #include <rpc/types.h>
 #include <rpc/xdr.h>
 #include <libintl.h>
+#include <limits.h>
 
 #ifdef USE_IN_LIBIO
 # include <wchar.h>
@@ -81,7 +82,11 @@
       return FALSE;
     }
   c = *sizep;
-  if ((c > maxsize) && (xdrs->x_op != XDR_FREE))
+  /*
+   * XXX: Let the overflow possibly happen with XDR_FREE because mem_free()
+   * doesn't actually use its second argument anyway.
+   */
+  if ((c > maxsize || c > UINT_MAX / elsize) && (xdrs->x_op != XDR_FREE))
     {
       return FALSE;
     }