From owner-freebsd-security@freebsd.org Wed Sep 30 20:13:49 2015 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 14A80A0B01C for ; Wed, 30 Sep 2015 20:13:49 +0000 (UTC) (envelope-from delphij@delphij.net) Received: from anubis.delphij.net (anubis.delphij.net [IPv6:2001:470:1:117::25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "anubis.delphij.net", Issuer "StartCom Class 1 Primary Intermediate Server CA" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id EC71718E3 for ; Wed, 30 Sep 2015 20:13:48 +0000 (UTC) (envelope-from delphij@delphij.net) Received: from zeta.ixsystems.com (unknown [12.229.62.2]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by anubis.delphij.net (Postfix) with ESMTPSA id 1664424C3F; Wed, 30 Sep 2015 13:13:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=delphij.net; s=anubis; t=1443644013; x=1443658413; bh=n1Mqaif+qbd5JoZ9i3eW4R8vg+mTxnJLjusdMBgtIWw=; h=Reply-To:Subject:References:To:Cc:From:Date:In-Reply-To; b=OdN912H25TwMD9x/yUoHuCfHU5O/qunBNCnp0qs9bn/wQzTXzUDui77OgcrA9DT79 RqIvqiO5DUSr0Ge+Ay7hZlFLGm8z8Cf34dihI6MvQgijCi5bGWITcOnsTX7Msdtsv+ QfmjjDat+kyNMUsOyBdYHJJWqAXXny3yKgEkSmG4= Reply-To: d@delphij.net Subject: Re: FreeBSD Security Advisory FreeBSD-SA-15:24.rpcbind References: <20150929183942.569F311FD@freefall.freebsd.org> <560C33B7.70100@delphij.net> <560C39B3.1020806@delphij.net> <560C3DF2.5070608@delphij.net> <20BCBD1F-D22E-4878-AB6C-CBE9F7FD4BF2@inoc.net> To: Robert Blayzor , d@delphij.net Cc: freebsd-security@freebsd.org From: Xin Li Organization: The FreeBSD Project Message-ID: <560C426B.1000608@delphij.net> Date: Wed, 30 Sep 2015 13:13:31 -0700 MIME-Version: 1.0 In-Reply-To: <20BCBD1F-D22E-4878-AB6C-CBE9F7FD4BF2@inoc.net> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="26W7StUUQMFgPLQQokSa7oFWaF9eBlqoj" X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Sep 2015 20:13:49 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --26W7StUUQMFgPLQQokSa7oFWaF9eBlqoj Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable On 09/30/15 13:03, Robert Blayzor wrote: > On Sep 30, 2015, at 3:54 PM, Xin Li wrote: >> >> Can you make this change and see if it helps? >> >> Index: rpcb_svc_com.c >> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >> --- rpcb_svc_com.c (revision 288421) >> +++ rpcb_svc_com.c (working copy) >> @@ -1052,7 +1052,7 @@ static bool_t >> netbuf_copybuf(struct netbuf *dst, const struct netbuf *src) >> { >> >> - assert(dst->buf =3D=3D NULL); >> + assert(dst->len =3D=3D 0 || dst->buf =3D=3D NULL); > =85 >=20 >=20 > Same result: >=20 >=20 > Assertion failed: (dst->len =3D=3D 0 || dst->buf =3D=3D NULL), function= netbuf_copybuf, file rpcb_svc_com.c, line 1056. Hmm this suggests there were either a use-after-free or a memory leak with existing code. I will need some time to further investigate this. In the meantime, please comment out the assertion (which turns the crash back into memory leak in the worst case). Cheers, --=20 Xin LI https://www.delphij.net/ FreeBSD - The Power to Serve! Live free or die --26W7StUUQMFgPLQQokSa7oFWaF9eBlqoj Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.1.8 (FreeBSD) iQIcBAEBCgAGBQJWDEJsAAoJEJW2GBstM+nsBtgP/0kmSJ7cc4io5sRCYL7T+Yzb rtsN+eKD/RHLnrzcXt0OwxQNzsvpoSCGliaOS+Q42FJ+UuJKdz3H9SOWdN2O4yDX gQiTzspkh3SQ0gj0+vfqJ7bjrvPN7EePXZJ1hKEomOvV+XOyxDS0AlOCN/ciIhcX b6i3L028DXUmsJHATVmTmGAHK2zmLUCSMgNF1jHE+S1zWQ2ordgKXo13Erfx6IgH iDeF6pSK29Cs9lNT0kcmUuvxysXBHtYpvhgJbpJt89ym7R71nl36EahbXBAOkrjt Ih0PzONmPMRxRWVTUD6EYu/ulZlQ2uwH6E/7NlwDmNdf6lw7MZWiAkWUQy9/yBbs 7VElXsLpTzCKIoLFPxK/cjdbFovQ4aRiT2e27hhpvehMfumtkf2r0wqS+e5Zi7N6 GC6eTsuiF9Q5A+hJBo/G1aWGqOo99fRWi8Lv4griqEnJSF6VOxPLcEbK+C0YiDZI fhl7OIuSwDULuoPLqQqIFWpDAEBHL6cLHRDxpB+vbbMs9wufhFWyqOHWMO7N5Eaa j7bWw8wWEkOzK8D6obI+1RBaJ+Pz4XI9qQ4pWW9jF5A9oDuDEjxJrqBVwK69P/S9 bswQ8tFxuiMhiDAcVozX+1b/iCtYi3MCpZGp497OmmOJmXu4391zjY04ZlaRw51J izI2qQbns4C1CCho0hcI =t5Ab -----END PGP SIGNATURE----- --26W7StUUQMFgPLQQokSa7oFWaF9eBlqoj--