From owner-freebsd-bugs@FreeBSD.ORG Tue Jul 12 19:00:18 2005 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C767C16A41C for ; Tue, 12 Jul 2005 19:00:18 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 4F37343D5C for ; Tue, 12 Jul 2005 19:00:18 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id j6CJ0B7C070854 for ; Tue, 12 Jul 2005 19:00:11 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.3/8.13.1/Submit) id j6CJ0BsD070848; Tue, 12 Jul 2005 19:00:11 GMT (envelope-from gnats) Resent-Date: Tue, 12 Jul 2005 19:00:11 GMT Resent-Message-Id: <200507121900.j6CJ0BsD070848@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Dan Lukes Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9087416A41C for ; Tue, 12 Jul 2005 18:56:26 +0000 (GMT) (envelope-from dan@kulesh.obluda.cz) Received: from kulesh.obluda.cz (kulesh.obluda.cz [193.179.22.243]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5A76543D48 for ; Tue, 12 Jul 2005 18:56:25 +0000 (GMT) (envelope-from dan@kulesh.obluda.cz) Received: from kulesh.obluda.cz (localhost.eunet.cz [127.0.0.1]) by kulesh.obluda.cz (8.13.3/8.13.3) with ESMTP id j6CIuNAi016504 for ; Tue, 12 Jul 2005 20:56:23 +0200 (CEST) (envelope-from dan@kulesh.obluda.cz) Received: (from root@localhost) by kulesh.obluda.cz (8.13.3/8.13.1/Submit) id j6CIuMml016503; Tue, 12 Jul 2005 20:56:22 +0200 (CEST) (envelope-from dan) Message-Id: <200507121856.j6CIuMml016503@kulesh.obluda.cz> Date: Tue, 12 Jul 2005 20:56:22 +0200 (CEST) From: Dan Lukes To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: Subject: bin/83344: [ PATCH ] Improper handling of malloc failures within libc's RPC functions X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Dan Lukes List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Jul 2005 19:00:19 -0000 >Number: 83344 >Category: bin >Synopsis: [ PATCH ] Improper handling of malloc failures within libc's RPC functions >Confidential: no >Severity: serious >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Tue Jul 12 19:00:10 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Dan Lukes >Release: FreeBSD 5.4-STABLE i386 >Organization: Obludarium >Environment: System: FreeBSD 5.4-STABLE #8: Sat Jul 9 16:31:08 CEST 2005 i386 lib/libc/rpc/rpcb_clnt.c,v 1.13 2003/10/29 09:22:49 mbr >Description: Improper handling of malloc failures cause the memory leak. Improper checking of targaddr parameter within getclnthandle() may cause dereferencing of NULL >How-To-Repeat: >Fix: --- patch begins here --- --- lib/libc/rpc/rpcb_clnt.c.ORIG Fri Nov 14 03:22:48 2003 +++ lib/libc/rpc/rpcb_clnt.c Tue Jul 12 20:26:30 2005 @@ -239,11 +239,21 @@ ad_cache->ac_taddr = (struct netbuf *)malloc(sizeof (struct netbuf)); if (!ad_cache->ac_host || !ad_cache->ac_netid || !ad_cache->ac_taddr || (uaddr && !ad_cache->ac_uaddr)) { + free(ad_cache->ac_host); + free(ad_cache->ac_netid); + free(ad_cache->ac_uaddr); + free(ad_cache->ac_taddr); + free(ad_cache); return; } ad_cache->ac_taddr->len = ad_cache->ac_taddr->maxlen = taddr->len; ad_cache->ac_taddr->buf = (char *) malloc(taddr->len); if (ad_cache->ac_taddr->buf == NULL) { + free(ad_cache->ac_host); + free(ad_cache->ac_netid); + free(ad_cache->ac_uaddr); + free(ad_cache->ac_taddr); + free(ad_cache); return; } memcpy(ad_cache->ac_taddr->buf, taddr->buf, taddr->len); @@ -375,9 +385,15 @@ } else { struct sockaddr_un sun; - *targaddr = malloc(sizeof(sun.sun_path)); - strncpy(*targaddr, _PATH_RPCBINDSOCK, - sizeof(sun.sun_path)); + if (targaddr) { + *targaddr = malloc(sizeof(sun.sun_path)); + if (*targaddr == NULL) { + CLNT_DESTROY(client); + return(NULL); + } + strncpy(*targaddr, _PATH_RPCBINDSOCK, + sizeof(sun.sun_path)); + } return (client); } } else { --- patch ends here --- Remember the free(NULL) is correct construction, so it's not necesarry to do something like if (x) free(x); >Release-Note: >Audit-Trail: >Unformatted: