Attachment 39735 Details for Bug 93652

[patch] Proposed fix

xdr-input-validation.diff (text/plain), 1.19 KB, created by Andreas Gruenbacher on 2005-06-23 10:42:01 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andreas Gruenbacher

Created: 2005-06-23 10:42:01 UTC

Size: 1.19 KB

patch

obsolete

>From: Andreas Gruenbacher <agruen@suse.de>
>Subject: Overflow in xdr input validation
>References: 93652
>
>The bounds check in xdr_xcode_array2 can overflow. Reported by
>Florian Weimer <fw@deneb.enyo.de>.
>
>Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
>
>Index: linux-2.6.5/net/sunrpc/xdr.c
>===================================================================
>--- linux-2.6.5.orig/net/sunrpc/xdr.c
>+++ linux-2.6.5/net/sunrpc/xdr.c
>@@ -989,8 +989,7 @@ xdr_xcode_array2(struct xdr_buf *buf, un
> 			return -EINVAL;
> 	} else {
> 		if (xdr_decode_word(buf, base, &desc->array_len) != 0 ||
>-		    (unsigned long) base + 4 + desc->array_len *
>-				    desc->elem_size > buf->len)
>+		    desc->array_len > (buf->len - base - 4) / desc->elem_size)
> 			return -EINVAL;
> 	}
> 	base += 4;
>@@ -1158,8 +1157,8 @@ int
> xdr_encode_array2(struct xdr_buf *buf, unsigned int base,
> 		  struct xdr_array2_desc *desc)
> {
>-	if ((unsigned long) base + 4 + desc->array_len * desc->elem_size >
>-	    buf->head->iov_len + buf->page_len + buf->tail->iov_len)
>+	if (buf->head->iov_len + buf->page_len + buf->tail->iov_len -
>+	    base < desc->array_len * desc->elem_size + 4)
> 		return -EINVAL;
> 
> 	return xdr_xcode_array2(buf, base, desc, 1);

Actions: View | Diff

Attachments on bug 93652: 39735