Răsfoiți Sursa

svcrpc: fix gss-proxy NULL dereference in some error cases

We depend on the xdr decoder to set this pointer, but if we error out
before we decode this piece it could be left NULL.

I think this is probably tough to hit without a buggy gss-proxy.

Reported-by: Andi Kleen <andi@firstfloor.org>
Cc: Simo Sorce <simo@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
J. Bruce Fields 12 ani în urmă
părinte
comite
c66080ad0a
1 a modificat fișierele cu 2 adăugiri și 1 ștergeri
  1. 2 1
      net/sunrpc/auth_gss/gss_rpc_upcall.c

+ 2 - 1
net/sunrpc/auth_gss/gss_rpc_upcall.c

@@ -298,7 +298,8 @@ int gssp_accept_sec_context_upcall(struct net *net,
 	if (res.context_handle) {
 		data->out_handle = rctxh.exported_context_token;
 		data->mech_oid.len = rctxh.mech.len;
-		memcpy(data->mech_oid.data, rctxh.mech.data,
+		if (rctxh.mech.data)
+			memcpy(data->mech_oid.data, rctxh.mech.data,
 						data->mech_oid.len);
 		client_name = rctxh.src_name.display_name;
 	}