Avoid buffer overruns by allocating buffer in svcauth_gss_validate()
Subsystems (2)
PATCH v3 1/1 Avoid buffer overruns by allocating buffer in svcauth_gss_validate()
Signed-off-by Steve Dickson <[email protected]>
--- src/svc_auth_gss.c | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-)
src/svc_auth_gss.c +7 -7
@@ -286,21 +286,19 @@ svcauth_gss_validate(struct svc_rpc_gss_data *gd, struct rpc_msg *msg)struct opaque_auth *oa;gss_buffer_desc rpcbuf, checksum;OM_uint32 maj_stat, min_stat, qop_state; -u_char rpchdr[128 ]; +u_char *rpchdr;int32_t *buf;gss_log_debug ("in svcauth_gss_validate()" ); -memset (rpchdr,0 ,sizeof (rpchdr)); -/* XXX - Reconstruct RPC header for signing (from xdr_callmsg). */ oa = &msg->rm_call.cb_cred;if (oa->oa_length >MAX_AUTH_BYTES )return (FALSE); - -/* 8 XDR units from the IXDR macro calls. */ -if (sizeof (rpchdr) < (8 *BYTES_PER_XDR_UNIT + -RNDUP (oa->oa_length))) + + rpchdr = (u_char *)calloc (((8 *BYTES_PER_XDR_UNIT ) + +RNDUP (oa->oa_length)),1 ); +if (rpchdr ==NULL )return (FALSE); buf = (int32_t *)rpchdr;
@@ -325,6 +323,8 @@ svcauth_gss_validate(struct svc_rpc_gss_data *gd, struct rpc_msg *msg) maj_stat =gss_verify_mic (&min_stat, gd->ctx, &rpcbuf, &checksum, &qop_state); +free (rpchdr); +if (maj_stat !=GSS_S_COMPLETE ) {gss_log_status ("gss_verify_mic" , maj_stat, min_stat);return (FALSE);
Signature · 1 line
1.7.1
Quoted 1 line · Steve Dickson
Signed-off-by Steve Dickson <[email protected]>
Reviewed-by Chuck Lever <[email protected]>
Quoted 51 lines
---
src/svc_auth_gss.c| 14 +++++++-------1 files changed, 7 insertions(+), 7 deletions(-)src/svc_auth_gss.c +7
-7@@ -286,21 +286,19 @@ svcauth_gss_validate(struct svc_rpc_gss_data *gd, struct rpc_msg *msg)struct opaque_auth *oa;gss_buffer_desc rpcbuf, checksum;OM_uint32 maj_stat, min_stat, qop_state; -u_char rpchdr[128 ]; +u_char *rpchdr;int32_t *buf;gss_log_debug ("in svcauth_gss_validate()" ); -memset (rpchdr,0 ,sizeof (rpchdr)); -/* XXX - Reconstruct RPC header for signing (from xdr_callmsg). */ oa = &msg->rm_call.cb_cred;if (oa->oa_length >MAX_AUTH_BYTES )return (FALSE); - -/* 8 XDR units from the IXDR macro calls. */ -if (sizeof (rpchdr) < (8 *BYTES_PER_XDR_UNIT + -RNDUP (oa->oa_length))) + + rpchdr = (u_char *)calloc (((8 *BYTES_PER_XDR_UNIT ) + +RNDUP (oa->oa_length)),1 ); +if (rpchdr ==NULL )return (FALSE); buf = (int32_t *)rpchdr;@@ -325,6 +323,8 @@ svcauth_gss_validate(struct svc_rpc_gss_data *gd, struct rpc_msg *msg) maj_stat =gss_verify_mic (&min_stat, gd->ctx, &rpcbuf, &checksum, &qop_state); +free (rpchdr); +if (maj_stat !=GSS_S_COMPLETE ) {gss_log_status ("gss_verify_mic" , maj_stat, min_stat);return (FALSE);Signature · 6 lines
1.7.1 -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
--
Chuck Lever
chuck[dot]lever[at]oracle[dot]com
Quoted 6 lines · Chuck Lever
Quoted 1 line · Steve Dickson
Signed-off-by Steve Dickson <[email protected]>Reviewed-by Chuck Lever <[email protected]>
Thank you... For your time!
steved.
Quoted 59 lines
Quoted 52 lines
---
src/svc_auth_gss.c| 14 +++++++-------1 files changed, 7 insertions(+), 7 deletions(-)src/svc_auth_gss.c +7
-7@@ -286,21 +286,19 @@ svcauth_gss_validate(struct svc_rpc_gss_data *gd, struct rpc_msg *msg)struct opaque_auth *oa;gss_buffer_desc rpcbuf, checksum;OM_uint32 maj_stat, min_stat, qop_state; -u_char rpchdr[128 ]; +u_char *rpchdr;int32_t *buf;gss_log_debug ("in svcauth_gss_validate()" ); -memset (rpchdr,0 ,sizeof (rpchdr)); -/* XXX - Reconstruct RPC header for signing (from xdr_callmsg). */ oa = &msg->rm_call.cb_cred;if (oa->oa_length >MAX_AUTH_BYTES )return (FALSE); - -/* 8 XDR units from the IXDR macro calls. */ -if (sizeof (rpchdr) < (8 *BYTES_PER_XDR_UNIT + -RNDUP (oa->oa_length))) + + rpchdr = (u_char *)calloc (((8 *BYTES_PER_XDR_UNIT ) + +RNDUP (oa->oa_length)),1 ); +if (rpchdr ==NULL )return (FALSE); buf = (int32_t *)rpchdr;@@ -325,6 +323,8 @@ svcauth_gss_validate(struct svc_rpc_gss_data *gd, struct rpc_msg *msg) maj_stat =gss_verify_mic (&min_stat, gd->ctx, &rpcbuf, &checksum, &qop_state); +free (rpchdr); +if (maj_stat !=GSS_S_COMPLETE ) {gss_log_status ("gss_verify_mic" , maj_stat, min_stat);return (FALSE);Signature · 6 lines
1.7.1 -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html--
Chuck Lever
chuck[dot]lever[at]oracle[dot]com
Quoted 1 line · Steve Dickson
Signed-off-by Steve Dickson <[email protected]>
Committed...
steved.
Quoted 45 lines
--- src/svc_auth_gss.c | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-)src/svc_auth_gss.c +7
-7@@ -286,21 +286,19 @@ svcauth_gss_validate(struct svc_rpc_gss_data *gd, struct rpc_msg *msg)struct opaque_auth *oa;gss_buffer_desc rpcbuf, checksum;OM_uint32 maj_stat, min_stat, qop_state; -u_char rpchdr[128 ]; +u_char *rpchdr;int32_t *buf;gss_log_debug ("in svcauth_gss_validate()" ); -memset (rpchdr,0 ,sizeof (rpchdr)); -/* XXX - Reconstruct RPC header for signing (from xdr_callmsg). */ oa = &msg->rm_call.cb_cred;if (oa->oa_length >MAX_AUTH_BYTES )return (FALSE); - -/* 8 XDR units from the IXDR macro calls. */ -if (sizeof (rpchdr) < (8 *BYTES_PER_XDR_UNIT + -RNDUP (oa->oa_length))) + + rpchdr = (u_char *)calloc (((8 *BYTES_PER_XDR_UNIT ) + +RNDUP (oa->oa_length)),1 ); +if (rpchdr ==NULL )return (FALSE); buf = (int32_t *)rpchdr;@@ -325,6 +323,8 @@ svcauth_gss_validate(struct svc_rpc_gss_data *gd, struct rpc_msg *msg) maj_stat =gss_verify_mic (&min_stat, gd->ctx, &rpcbuf, &checksum, &qop_state); +free (rpchdr); +if (maj_stat !=GSS_S_COMPLETE ) {gss_log_status ("gss_verify_mic" , maj_stat, min_stat);return (FALSE);