Skip to content

Commit

Permalink
MFC r319369:
Browse files Browse the repository at this point in the history 
 * limit size of buffers to RPC_MAXDATASIZE
 * don't leak memory
 * be more picky about bad parameters

From:

https://raw.githubusercontent.com/guidovranken/rpcbomb/master/libtirpc_patch.txt
https://github.com/guidovranken/rpcbomb/blob/master/rpcbind_patch.txt

via NetBSD.


git-svn-id: https://svn.freebsd.org/base/stable/10@319615 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f
  • Loading branch information
delphij committed Jun 6, 2017
1 parent 3446229 commit a6a76b7
Show file tree
Hide file tree
Showing 9 changed files with 96 additions and 30 deletions.
8 changes: 8 additions & 0 deletions lib/libc/rpc/rpc_generic.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -610,6 +610,8 @@ __rpc_taddr2uaddr_af(int af, const struct netbuf *nbuf)

switch (af) {
case AF_INET:
if (nbuf->len < sizeof(*sin))
return NULL;
sin = nbuf->buf;
if (inet_ntop(af, &sin->sin_addr, namebuf, sizeof namebuf)
== NULL)
Expand All @@ -621,6 +623,8 @@ __rpc_taddr2uaddr_af(int af, const struct netbuf *nbuf)
break;
#ifdef INET6
case AF_INET6:
if (nbuf->len < sizeof(*sin6))
return NULL;
sin6 = nbuf->buf;
if (inet_ntop(af, &sin6->sin6_addr, namebuf6, sizeof namebuf6)
== NULL)
Expand Down Expand Up @@ -659,6 +663,10 @@ __rpc_uaddr2taddr_af(int af, const char *uaddr)

port = 0;
sin = NULL;

if (uaddr == NULL)
return NULL;

addrstr = strdup(uaddr);
if (addrstr == NULL)
return NULL;
Expand Down
17 changes: 9 additions & 8 deletions lib/libc/rpc/rpcb_prot.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,7 @@ __FBSDID("$FreeBSD$");
#include <rpc/types.h>
#include <rpc/xdr.h>
#include <rpc/rpcb_prot.h>
#include <rpc/rpc_com.h>
#include "un-namespace.h"

bool_t
Expand All @@ -62,13 +63,13 @@ xdr_rpcb(XDR *xdrs, RPCB *objp)
if (!xdr_rpcvers(xdrs, &objp->r_vers)) {
return (FALSE);
}
if (!xdr_string(xdrs, &objp->r_netid, (u_int)~0)) {
if (!xdr_string(xdrs, &objp->r_netid, RPC_MAXDATASIZE)) {
return (FALSE);
}
if (!xdr_string(xdrs, &objp->r_addr, (u_int)~0)) {
if (!xdr_string(xdrs, &objp->r_addr, RPC_MAXDATASIZE)) {
return (FALSE);
}
if (!xdr_string(xdrs, &objp->r_owner, (u_int)~0)) {
if (!xdr_string(xdrs, &objp->r_owner, RPC_MAXDATASIZE)) {
return (FALSE);
}
return (TRUE);
Expand Down Expand Up @@ -162,19 +163,19 @@ xdr_rpcblist(XDR *xdrs, RPCBLIST **rp)
bool_t
xdr_rpcb_entry(XDR *xdrs, rpcb_entry *objp)
{
if (!xdr_string(xdrs, &objp->r_maddr, (u_int)~0)) {
if (!xdr_string(xdrs, &objp->r_maddr, RPC_MAXDATASIZE)) {
return (FALSE);
}
if (!xdr_string(xdrs, &objp->r_nc_netid, (u_int)~0)) {
if (!xdr_string(xdrs, &objp->r_nc_netid, RPC_MAXDATASIZE)) {
return (FALSE);
}
if (!xdr_u_int32_t(xdrs, &objp->r_nc_semantics)) {
return (FALSE);
}
if (!xdr_string(xdrs, &objp->r_nc_protofmly, (u_int)~0)) {
if (!xdr_string(xdrs, &objp->r_nc_protofmly, RPC_MAXDATASIZE)) {
return (FALSE);
}
if (!xdr_string(xdrs, &objp->r_nc_proto, (u_int)~0)) {
if (!xdr_string(xdrs, &objp->r_nc_proto, RPC_MAXDATASIZE)) {
return (FALSE);
}
return (TRUE);
Expand Down Expand Up @@ -289,7 +290,7 @@ xdr_rpcb_rmtcallres(XDR *xdrs, struct rpcb_rmtcallres *p)
bool_t dummy;
struct r_rpcb_rmtcallres *objp = (struct r_rpcb_rmtcallres *)(void *)p;

if (!xdr_string(xdrs, &objp->addr, (u_int)~0)) {
if (!xdr_string(xdrs, &objp->addr, RPC_MAXDATASIZE)) {
return (FALSE);
}
if (!xdr_u_int(xdrs, &objp->results.results_len)) {
Expand Down
9 changes: 5 additions & 4 deletions lib/libc/rpc/rpcb_st_xdr.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ __FBSDID("$FreeBSD$");

#include "namespace.h"
#include <rpc/rpc.h>
#include <rpc/rpc_com.h>
#include "un-namespace.h"

/* Link list of all the stats about getport and getaddr */
Expand All @@ -63,7 +64,7 @@ xdr_rpcbs_addrlist(XDR *xdrs, rpcbs_addrlist *objp)
if (!xdr_int(xdrs, &objp->failure)) {
return (FALSE);
}
if (!xdr_string(xdrs, &objp->netid, (u_int)~0)) {
if (!xdr_string(xdrs, &objp->netid, RPC_MAXDATASIZE)) {
return (FALSE);
}

Expand Down Expand Up @@ -115,7 +116,7 @@ xdr_rpcbs_rmtcalllist(XDR *xdrs, rpcbs_rmtcalllist *objp)
IXDR_PUT_INT32(buf, objp->failure);
IXDR_PUT_INT32(buf, objp->indirect);
}
if (!xdr_string(xdrs, &objp->netid, (u_int)~0)) {
if (!xdr_string(xdrs, &objp->netid, RPC_MAXDATASIZE)) {
return (FALSE);
}
pnext = &objp->next;
Expand Down Expand Up @@ -154,7 +155,7 @@ xdr_rpcbs_rmtcalllist(XDR *xdrs, rpcbs_rmtcalllist *objp)
objp->failure = (int)IXDR_GET_INT32(buf);
objp->indirect = (int)IXDR_GET_INT32(buf);
}
if (!xdr_string(xdrs, &objp->netid, (u_int)~0)) {
if (!xdr_string(xdrs, &objp->netid, RPC_MAXDATASIZE)) {
return (FALSE);
}
if (!xdr_pointer(xdrs, (char **) pnext,
Expand Down Expand Up @@ -182,7 +183,7 @@ xdr_rpcbs_rmtcalllist(XDR *xdrs, rpcbs_rmtcalllist *objp)
if (!xdr_int(xdrs, &objp->indirect)) {
return (FALSE);
}
if (!xdr_string(xdrs, &objp->netid, (u_int)~0)) {
if (!xdr_string(xdrs, &objp->netid, RPC_MAXDATASIZE)) {
return (FALSE);
}
if (!xdr_pointer(xdrs, (char **) pnext,
Expand Down
30 changes: 25 additions & 5 deletions lib/libc/xdr/xdr.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,8 @@ __FBSDID("$FreeBSD$");
#include <stdlib.h>
#include <string.h>

#include <rpc/rpc.h>
#include <rpc/rpc_com.h>
#include <rpc/types.h>
#include <rpc/xdr.h>
#include "un-namespace.h"
Expand All @@ -64,7 +66,6 @@ typedef u_quad_t u_longlong_t; /* ANSI unsigned long long type */
*/
#define XDR_FALSE ((long) 0)
#define XDR_TRUE ((long) 1)
#define LASTUNSIGNED ((u_int) 0-1)

/*
* for unit alignment
Expand Down Expand Up @@ -602,6 +603,7 @@ xdr_bytes(xdrs, cpp, sizep, maxsize)
{
char *sp = *cpp; /* sp is the actual string pointer */
u_int nodesize;
bool_t ret, allocated = FALSE;

/*
* first deal with the length since xdr bytes are counted
Expand All @@ -625,6 +627,7 @@ xdr_bytes(xdrs, cpp, sizep, maxsize)
}
if (sp == NULL) {
*cpp = sp = mem_alloc(nodesize);
allocated = TRUE;
}
if (sp == NULL) {
warnx("xdr_bytes: out of memory");
Expand All @@ -633,7 +636,14 @@ xdr_bytes(xdrs, cpp, sizep, maxsize)
/* FALLTHROUGH */

case XDR_ENCODE:
return (xdr_opaque(xdrs, sp, nodesize));
ret = xdr_opaque(xdrs, sp, nodesize);
if ((xdrs->x_op == XDR_DECODE) && (ret == FALSE)) {
if (allocated == TRUE) {
free(sp);
*cpp = NULL;
}
}
return (ret);

case XDR_FREE:
if (sp != NULL) {
Expand Down Expand Up @@ -727,6 +737,7 @@ xdr_string(xdrs, cpp, maxsize)
char *sp = *cpp; /* sp is the actual string pointer */
u_int size;
u_int nodesize;
bool_t ret, allocated = FALSE;

/*
* first deal with the length since xdr strings are counted-strings
Expand Down Expand Up @@ -760,8 +771,10 @@ xdr_string(xdrs, cpp, maxsize)
if (nodesize == 0) {
return (TRUE);
}
if (sp == NULL)
if (sp == NULL) {
*cpp = sp = mem_alloc(nodesize);
allocated = TRUE;
}
if (sp == NULL) {
warnx("xdr_string: out of memory");
return (FALSE);
Expand All @@ -770,7 +783,14 @@ xdr_string(xdrs, cpp, maxsize)
/* FALLTHROUGH */

case XDR_ENCODE:
return (xdr_opaque(xdrs, sp, size));
ret = xdr_opaque(xdrs, sp, size);
if ((xdrs->x_op == XDR_DECODE) && (ret == FALSE)) {
if (allocated == TRUE) {
free(sp);
*cpp = NULL;
}
}
return (ret);

case XDR_FREE:
mem_free(sp, nodesize);
Expand All @@ -790,7 +810,7 @@ xdr_wrapstring(xdrs, cpp)
XDR *xdrs;
char **cpp;
{
return xdr_string(xdrs, cpp, LASTUNSIGNED);
return xdr_string(xdrs, cpp, RPC_MAXDATASIZE);
}

/*
Expand Down
8 changes: 8 additions & 0 deletions sys/rpc/rpc_generic.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -311,6 +311,8 @@ __rpc_taddr2uaddr_af(int af, const struct netbuf *nbuf)

switch (af) {
case AF_INET:
if (nbuf->len < sizeof(*sin))
return NULL;
sin = nbuf->buf;
if (inet_ntop(af, &sin->sin_addr, namebuf, sizeof namebuf)
== NULL)
Expand All @@ -323,6 +325,8 @@ __rpc_taddr2uaddr_af(int af, const struct netbuf *nbuf)
break;
#ifdef INET6
case AF_INET6:
if (nbuf->len < sizeof(*sin6))
return NULL;
sin6 = nbuf->buf;
if (inet_ntop(af, &sin6->sin6_addr, namebuf6, sizeof namebuf6)
== NULL)
Expand Down Expand Up @@ -366,6 +370,10 @@ __rpc_uaddr2taddr_af(int af, const char *uaddr)

port = 0;
sin = NULL;

if (uaddr == NULL)
return NULL;

addrstr = strdup(uaddr, M_RPC);
if (addrstr == NULL)
return NULL;
Expand Down
5 changes: 5 additions & 0 deletions sys/rpc/rpcb_clnt.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1287,6 +1287,11 @@ xdr_netbuf(XDR *xdrs, struct netbuf *objp)
return (FALSE);
}
pp = &objp->buf;

if (objp->maxlen > RPC_MAXDATASIZE) {
return (FALSE);
}

dummy = xdr_bytes(xdrs, (char **) pp,
(u_int *)&(objp->len), objp->maxlen);
return (dummy);
Expand Down
15 changes: 8 additions & 7 deletions sys/rpc/rpcb_prot.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,7 @@ __FBSDID("$FreeBSD$");
#include <sys/malloc.h>

#include <rpc/rpc.h>
#include <rpc/rpc_com.h>
#include <rpc/rpcb_prot.h>

bool_t
Expand All @@ -74,13 +75,13 @@ xdr_rpcb(XDR *xdrs, RPCB *objp)
if (!xdr_uint32_t(xdrs, &objp->r_vers)) {
return (FALSE);
}
if (!xdr_string(xdrs, &objp->r_netid, (u_int)~0)) {
if (!xdr_string(xdrs, &objp->r_netid, RPC_MAXDATASIZE)) {
return (FALSE);
}
if (!xdr_string(xdrs, &objp->r_addr, (u_int)~0)) {
if (!xdr_string(xdrs, &objp->r_addr, RPC_MAXDATASIZE)) {
return (FALSE);
}
if (!xdr_string(xdrs, &objp->r_owner, (u_int)~0)) {
if (!xdr_string(xdrs, &objp->r_owner, RPC_MAXDATASIZE)) {
return (FALSE);
}
return (TRUE);
Expand Down Expand Up @@ -175,19 +176,19 @@ xdr_rpcblist(XDR *xdrs, RPCBLIST **rp)
bool_t
xdr_rpcb_entry(XDR *xdrs, rpcb_entry *objp)
{
if (!xdr_string(xdrs, &objp->r_maddr, (u_int)~0)) {
if (!xdr_string(xdrs, &objp->r_maddr, RPC_MAXDATASIZE)) {
return (FALSE);
}
if (!xdr_string(xdrs, &objp->r_nc_netid, (u_int)~0)) {
if (!xdr_string(xdrs, &objp->r_nc_netid, RPC_MAXDATASIZE)) {
return (FALSE);
}
if (!xdr_uint32_t(xdrs, &objp->r_nc_semantics)) {
return (FALSE);
}
if (!xdr_string(xdrs, &objp->r_nc_protofmly, (u_int)~0)) {
if (!xdr_string(xdrs, &objp->r_nc_protofmly, RPC_MAXDATASIZE)) {
return (FALSE);
}
if (!xdr_string(xdrs, &objp->r_nc_proto, (u_int)~0)) {
if (!xdr_string(xdrs, &objp->r_nc_proto, RPC_MAXDATASIZE)) {
return (FALSE);
}
return (TRUE);
Expand Down
Loading

0 comments on commit a6a76b7

Please sign in to comment.