Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dc43376c authored by J. Bruce Fields's avatar J. Bruce Fields
Browse files

svcrpc: fix gss-proxy xdr decoding oops 



Uninitialized stack data was being used as the destination for memcpy's.

Longer term we'll just delete some of this code; all we're doing is
skipping over xdr that we don't care about.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
parent 9f96392b

net/sunrpc/auth_gss/gss_rpc_xdr.c

+5 −4
Original line number Diff line number Diff line
@@ -430,7 +430,7 @@ static int dummy_enc_nameattr_array(struct xdr_stream *xdr, 
static int dummy_dec_nameattr_array(struct xdr_stream *xdr,

				    struct gssx_name_attr_array *naa)

{

	struct gssx_name_attr dummy;

	struct gssx_name_attr dummy = { .attr = {.len = 0} };

	u32 count, i;

	__be32 *p;
@@ -493,12 +493,13 @@ static int gssx_enc_name(struct xdr_stream *xdr, 
	return err;

}





static int gssx_dec_name(struct xdr_stream *xdr,

			 struct gssx_name *name)

{

	struct xdr_netobj dummy_netobj;

	struct gssx_name_attr_array dummy_name_attr_array;

	struct gssx_option_array dummy_option_array;

	struct xdr_netobj dummy_netobj = { .len = 0 };

	struct gssx_name_attr_array dummy_name_attr_array = { .count = 0 };

	struct gssx_option_array dummy_option_array = { .count = 0 };

	int err;



	/* name->display_name */