[PATCH] fix xdr routines to utilize the already defined limits for certain YP requests

[Jeff Law]

On 10/01/2012 12:12 PM, Patsy Franklin wrote:
> Hi,
>
> It was recently reported that an xdr request with an incorrect length
> field could cause glibc to allocate huge amounts of memory when parsing
> the xdr request.
>
> This bug exposed the fact that the xdr_ functions were allocating memory
> based on the length in the xdr request rather than the maximum size
> specified by the YP protocol.
>
> This patch fixes various xdr routines to utilize the already defined
> limits for certain YP requests.
>
> Thanks!
> Patsy Franklin
>
>
> 2012-09-25  Patsy Franklin <pfrankli@redhat.com>
>                      Honza Horak <hhorak@redhat.com>
>
>      * nis/yp_xdr.c (xdr_domainname): Use YPMAXDOMAIN as maxsize.
>      (xdr_mapname): Use YPMAXMAP as maxsize.
>      (xdr_peername): Use YPMAXPEER as maxsize.
>      (xdr_keydat): Use YPAXRECORD as maxsize.
>      (xdr_valdat): Use YPMAXRECORD as maxsize.
Just a note.  When you post a patch, it should be a diff against the 
head of the official glibc sources.  This diff is against a very old 
version of glibc.

I'm confirmed these changes build & regression test without problems. 
I've also confirmed that the OpenBSD sources use the same limits on 
these calls to xdr_string and xdr_bytes.

Honza also checked this patch avoids the large allocations when the xdr 
code is presented with the bogus/malicious xdr packet.

I've updated the patch to apply to the head of trunk and installed it. 
I'm attaching the installed patch to this message for archival purposes.

Jeff
-------------- next part --------------
diff --git a/ChangeLog b/ChangeLog
index b1ec572..83a0349 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2012-10-01  Patsy Franklin <pfrankli@redhat.com>
+            Honza Horak <hhorak@redhat.com>
+
+	* nis/yp_xdr.c (xdr_domainname): Use YPMAXDOMAIN as maxsize.
+	(xdr_mapname): Use YPMAXMAP as maxsize.
+	(xdr_peername): Use YPMAXPEER as maxsize.
+	(xdr_keydat): Use YPAXRECORD as maxsize.
+	(xdr_valdat): Use YPMAXRECORD as maxsize.
+
 2012-10-01  Roland McGrath  <roland@hack.frob.com>
 
 	* io/openat.c [!__ASSUME_ATFCTS] (__have_atfcts): New global variable.
diff --git a/nis/yp_xdr.c b/nis/yp_xdr.c
index 76e0f2f..4188506 100644
--- a/nis/yp_xdr.c
+++ b/nis/yp_xdr.c
@@ -49,21 +49,21 @@ libnsl_hidden_def (xdr_ypxfrstat)
 bool_t
 xdr_domainname (XDR *xdrs, domainname *objp)
 {
-  return xdr_string (xdrs, objp, ~0);
+  return xdr_string (xdrs, objp, YPMAXDOMAIN);
 }
 libnsl_hidden_def (xdr_domainname)
 
 bool_t
 xdr_mapname (XDR *xdrs, mapname *objp)
 {
-  return xdr_string (xdrs, objp, ~0);
+  return xdr_string (xdrs, objp, YPMAXMAP);
 }
 libnsl_hidden_def (xdr_mapname)
 
 bool_t
 xdr_peername (XDR *xdrs, peername *objp)
 {
-  return xdr_string (xdrs, objp, ~0);
+  return xdr_string (xdrs, objp, YPMAXPEER);
 }
 libnsl_hidden_def (xdr_peername)
 
@@ -71,7 +71,7 @@ bool_t
 xdr_keydat (XDR *xdrs, keydat *objp)
 {
   return xdr_bytes (xdrs, (char **) &objp->keydat_val,
-		    (u_int *) &objp->keydat_len, ~0);
+		    (u_int *) &objp->keydat_len, YPMAXRECORD);
 }
 libnsl_hidden_def (xdr_keydat)
 
@@ -79,7 +79,7 @@ bool_t
 xdr_valdat (XDR *xdrs, valdat *objp)
 {
   return xdr_bytes (xdrs, (char **) &objp->valdat_val,
-		    (u_int *) &objp->valdat_len, ~0);
+		    (u_int *) &objp->valdat_len, YPMAXRECORD);
 }
 libnsl_hidden_def (xdr_valdat)