| Fix on-stack buffer overflow in RPCSEC_GSS packet validation implementation |
| |
| --- /var/archive3/public/freebsd-releng-10.4-src/lib/librpcsec_gss/svc_rpcsec_gss.c 2017-09-29 08:20:16.000000000 +0800 |
| +++ freebsd-10.4/lib/librpcsec_gss/svc_rpcsec_gss.c 2026-06-25 15:47:03.703403000 +0800 |
| @@ -774,6 +774,10 @@ |
| oa = &msg->rm_call.cb_cred; |
| IXDR_PUT_ENUM(buf, oa->oa_flavor); |
| IXDR_PUT_LONG(buf, oa->oa_length); |
| + if(oa->oa_length > sizeof rpchdr - ((char *)buf - (char *)rpchdr)) { |
| + client->cl_state = CLIENT_STALE; |
| + return FALSE; |
| + } |
| if (oa->oa_length) { |
| memcpy((caddr_t)buf, oa->oa_base, oa->oa_length); |
| buf += RNDUP(oa->oa_length) / sizeof(int32_t); |
| --- /var/archive3/public/freebsd-releng-10.4-src/sys/rpc/rpcsec_gss/svc_rpcsec_gss.c 2017-09-29 08:20:08.000000000 +0800 |
| +++ freebsd-10.4/sys/rpc/rpcsec_gss/svc_rpcsec_gss.c 2026-06-25 15:47:16.880278000 +0800 |
| @@ -1005,6 +1005,10 @@ |
| oa = &msg->rm_call.cb_cred; |
| IXDR_PUT_ENUM(buf, oa->oa_flavor); |
| IXDR_PUT_LONG(buf, oa->oa_length); |
| + if(oa->oa_length > sizeof rpchdr - ((char *)buf - (char *)rpchdr)) { |
| + client->cl_state = CLIENT_STALE; |
| + return FALSE; |
| + } |
| if (oa->oa_length) { |
| memcpy((caddr_t)buf, oa->oa_base, oa->oa_length); |
| buf += RNDUP(oa->oa_length) / sizeof(int32_t); |