[PATCH] sunrpc: xdr_bytes/xdr_string need to free buffer on error [BZ #21461]

[Florian Weimer]

On 05/08/2017 10:39 AM, Andreas Schwab wrote:
> On Mai 08 2017, Florian Weimer <fweimer@redhat.com> wrote:
> 
>> +* The xdr_bytes and xdr_string routines free the internally allocated
>> +  buffer if deserialization of the buffer contents fails for any reason.
> 
> Isn't it the caller's responsibility to call the XDR functions with
> XDR_FREE in any case?

Hmm.  Interesting point.  I don't have Sun RPC documentation which is 
that precise.

But it's certainly true for complex types—the code rpcgen produces seems 
to assume that the caller calls XDR_FREE on deserialization failure.

But things get a bit weird for xdr_string here.  It calls strlen on the 
allocated buffer, which is not initialized after a deserialization 
failure.  This is done so that a value can be passed to mem_free, but I 
don't think we have a mem_free implementation which uses this value.  It 
would also be wrong if the successfully deserialized string contains a 
NUL byte.

Thanks,
Florian