Date: Wed, 10 Oct 2012 22:25:48 GMT From: Ritesh Shah <ritesh_shah2000@yahoo.com> To: freebsd-gnats-submit@FreeBSD.org Subject: misc/172576: librpc segfaults when out of memory Message-ID: <201210102225.q9AMPmTF040017@red.freebsd.org> Resent-Message-ID: <201210102258.q9AMwNDh003775@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 172576
>Category: misc
>Synopsis: librpc segfaults when out of memory
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed Oct 10 22:58:22 UTC 2012
>Closed-Date:
>Last-Modified:
>Originator: Ritesh Shah
>Release: 7.2, 8.1, 9.0
>Organization:
>Environment:
7.2-RELEASE-p4 FreeBSD 7.2-RELEASE-p4 #0: Fri Oct 2 08:22:32 UTC 2009 root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC amd64
>Description:
xdrrec_create() routine in lib/libc/xdr/xdr_rec.c returns a void. Under low memory condition this routine can bail out early and leave part of the XDR structrure uninitialized.
The callers :
clnt_vc_create() in lib/libc/rpc/clnt_vc.c &
makefd_xprt() in lib/libc/rpc/svc_vc.c
do not check whether failed or not.
This can lead to segfault when uninitialized pointers are accessed.
This bug exists in FreeBSD 9 as well.
192 rstrm->in_base = mem_alloc(recvsize);
193 if (rstrm->in_base == NULL) {
194 warnx("xdrrec_create: out of memory");
195 mem_free(rstrm->out_base, sendsize);
196 mem_free(rstrm, sizeof(RECSTREAM));
197 return;
198 }
199 /*
200 * now the rest ...
201 */
202 xdrs->x_ops = &xdrrec_ops;
203 xdrs->x_private = rstrm;
204 rstrm->tcp_handle = tcp_handle;
>How-To-Repeat:
>Fix:
It has been reported against netbsd as well.
http://mail-index.netbsd.org/netbsd-bugs/2012/08/06/msg029375.html
I can provide a patch if there is an agreement on how it should be fixed.
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201210102225.q9AMPmTF040017>