Module Name: src
Committed By: christos
Date: Tue Nov 23 14:02:01 UTC 2010
Modified Files:
src/lib/libc/rpc: xdr_rec.c
Log Message:
PR/44132: Wolfgang Stukenbrock: libc/rpc may overwrite not-allocated memory
Return XPRT_DIED when realloc fails for lack of a better error.
To generate a diff of this commit:
cvs rdiff -u -r1.30 -r1.31 src/lib/libc/rpc/xdr_rec.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/lib/libc/rpc/xdr_rec.c
diff -u src/lib/libc/rpc/xdr_rec.c:1.30 src/lib/libc/rpc/xdr_rec.c:1.31
--- src/lib/libc/rpc/xdr_rec.c:1.30 Wed Feb 11 23:40:40 2009
+++ src/lib/libc/rpc/xdr_rec.c Tue Nov 23 09:02:01 2010
@@ -1,4 +1,4 @@
-/* $NetBSD: xdr_rec.c,v 1.30 2009/02/12 04:40:40 lukem Exp $ */
+/* $NetBSD: xdr_rec.c,v 1.31 2010/11/23 14:02:01 christos Exp $ */
/*
* Sun RPC is a product of Sun Microsystems, Inc. and is provided for
@@ -35,7 +35,7 @@
static char *sccsid = "@(#)xdr_rec.c 1.21 87/08/11 Copyr 1984 Sun Micro";
static char *sccsid = "@(#)xdr_rec.c 2.2 88/08/01 4.0 RPCSRC";
#else
-__RCSID("$NetBSD: xdr_rec.c,v 1.30 2009/02/12 04:40:40 lukem Exp $");
+__RCSID("$NetBSD: xdr_rec.c,v 1.31 2010/11/23 14:02:01 christos Exp $");
#endif
#endif
@@ -581,8 +581,12 @@
return FALSE;
}
rstrm->in_reclen += fraglen;
- if ((u_int)rstrm->in_reclen > rstrm->recvsize)
- realloc_stream(rstrm, rstrm->in_reclen);
+ if ((u_int)rstrm->in_reclen > rstrm->recvsize) {
+ if (!realloc_stream(rstrm, rstrm->in_reclen)) {
+ *statp = XPRT_DIED;
+ return FALSE;
+ }
+ }
if (rstrm->in_header & LAST_FRAG) {
rstrm->in_header &= ~LAST_FRAG;
rstrm->last_frag = TRUE;
