Project

General

Profile

Bug #8180

Invalid netbuf decoded by xdr_netbuf()

Added by Marcel Telka over 2 years ago. Updated over 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
lib - userland libraries
Start date:
2017-05-08
Due date:
% Done:

100%

Estimated time:
Difficulty:
Medium
Tags:
needs-triage

Description

In a case the maxbuf field of the netbuf structure in the incoming XDR stream is different than the actual len of the data then the xdr_netbuf() function might decode the improperly sized netbuf structure. In such a case the allocated buffer size for the netbuf data won't be maxlen, but len instead. This violates the netbuf semantics where the maxlen field denotes the allocated (IOW, max) size of the buffer pointed by buf, while len is just the actual length of the used data in the buf buffer.

Fortunately, I didn't found any xdr_netbuf() consumer that might be affected by this.


Files

test.c (495 Bytes) test.c Marcel Telka, 2017-05-08 08:12 AM

History

#1

Updated by Marcel Telka over 2 years ago

  • File test.c added

The problem is clearly visible by running the attached test.c program:

$ ./test 
maxlen: 65536
len: 1
Segmentation Fault (core dumped)
$
#2

Updated by Marcel Telka over 2 years ago

  • File deleted (test.c)
#3

Updated by Marcel Telka over 2 years ago

#4

Updated by Marcel Telka over 2 years ago

  • Subject changed from Invalid netbuf from xdr_netbuf() to Invalid netbuf decoded by xdr_netbuf()
#6

Updated by Marcel Telka over 2 years ago

  • Status changed from In Progress to Pending RTI
#7

Updated by Electric Monk over 2 years ago

  • Status changed from Pending RTI to Closed
  • % Done changed from 0 to 100

git commit cfa354e4631308e491ed50bfe99d3cf93cc69bd9

commit  cfa354e4631308e491ed50bfe99d3cf93cc69bd9
Author: Marcel Telka <marcel@telka.sk>
Date:   2017-05-13T21:12:32.000Z

    8180 Invalid netbuf decoded by xdr_netbuf()
    Reviewed by: Arne Jansen <arne@die-jansens.de>
    Reviewed by: Yuri Pankov <yuri.pankov@gmail.com>
    Reviewed by: Vitaliy Gusev <gusev.vitaliy@icloud.com>
    Approved by: Gordon Ross <gordon.w.ross@gmail.com>

Also available in: Atom PDF