]> sourceware.org Git - glibc.git/commit
sunrpc: Avoid use-after-free read access in clntudp_call [BZ #21115]
authorFlorian Weimer <fweimer@redhat.com>
Tue, 28 Feb 2017 16:05:46 +0000 (17:05 +0100)
committerMike Frysinger <vapier@gentoo.org>
Sun, 12 Mar 2017 22:08:22 +0000 (15:08 -0700)
commit55df1000167b0143106e063f23159515d0c9c61c
tree642f81158890587e595792567da6d8aecefecfce
parent0232af1ad6cbd8378025e804f535ce9449ad49de
sunrpc: Avoid use-after-free read access in clntudp_call [BZ #21115]

After commit bc779a1a5b3035133024b21e2f339fe4219fb11c
(CVE-2016-4429: sunrpc: Do not use alloca in clntudp_call
[BZ #20112]), ancillary data is stored on the heap,
but it is accessed after it has been freed.

The test case must be run under a heap debugger such as valgrind
to observe the invalid access.  A malloc implementation which
immediately calls munmap on free would catch this bug as well.

(cherry picked from commit d42eed4a044e5e10dfb885cf9891c2518a72a491)
(cherry picked from commit 045e368799cd253ddbf8bdec42ed92e8ebb3ce67)
sunrpc/Makefile
sunrpc/clnt_udp.c
sunrpc/tst-udp-error.c [new file with mode: 0644]
This page took 0.041163 seconds and 5 git commands to generate.