From owner-freebsd-bugs@FreeBSD.ORG Thu Feb 9 14:10:02 2006 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id BF2A916A420 for ; Thu, 9 Feb 2006 14:10:02 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 16B8243D4C for ; Thu, 9 Feb 2006 14:10:02 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id k19EA1hl086211 for ; Thu, 9 Feb 2006 14:10:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.4/8.13.4/Submit) id k19EA14H086206; Thu, 9 Feb 2006 14:10:01 GMT (envelope-from gnats) Resent-Date: Thu, 9 Feb 2006 14:10:01 GMT Resent-Message-Id: <200602091410.k19EA14H086206@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Jan Stary Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id EFF3816A420 for ; Thu, 9 Feb 2006 14:03:27 +0000 (GMT) (envelope-from hans@stare.cz) Received: from ns.stare.cz (ns.stare.cz [81.95.102.106]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7F7DB43D64 for ; Thu, 9 Feb 2006 14:03:27 +0000 (GMT) (envelope-from hans@stare.cz) Received: by ns.stare.cz (Postfix, from userid 1001) id 3E444B865; Thu, 9 Feb 2006 15:03:25 +0100 (CET) Message-Id: <20060209140325.3E444B865@ns.stare.cz> Date: Thu, 9 Feb 2006 15:03:25 +0100 (CET) From: Jan Stary To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: Subject: kern/93093: xdr_string might call strlen(3) on NULL X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Jan Stary List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Feb 2006 14:10:02 -0000 >Number: 93093 >Category: kern >Synopsis: xdr_string might call strlen(3) on NULL >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Thu Feb 09 14:10:01 GMT 2006 >Closed-Date: >Last-Modified: >Originator: Jan Stary >Release: FreeBSD 6.0-RELEASE-p1 i386 >Organization: >Environment: System: FreeBSD dell.stare.cz 6.0-RELEASE-p1 FreeBSD 6.0-RELEASE-p1 #3: Sat Jan 14 13:55:07 CET 2006 root@dell.stare.cz:/usr/obj/usr/src/sys/DELLLS i386 >Description: The xdr_string(3) routine as present in usr/src/lib/libc/xdr/xdr.c calls strlen() on the passed string during XDR_ENCODE, without checking if it is NULL: xdr_string(xdrs, cpp, maxsize) { char *sp = *cpp; /* sp is the actual string pointer */ switch (xdrs->x_op) { case XDR_ENCODE: size = strlen(sp); break; >How-To-Repeat: #include #include #include #include #include int main() { XDR xdrs; char *string = NULL; xdrs.x_ops = NULL; xdrstdio_create(&xdrs, stdout, XDR_ENCODE); if(NULL==xdrs.x_ops) { fprintf(stderr, "x_ops still NULL after initialization!\n"); return 1; } string = NULL; /* this will make xdr_string dump a core */ /* string = strdup("this will get correctly encoded"); */ if(! xdr_string(&xdrs, &string, 64)) { fprintf(stderr, "cannot XDR_ENCODE string!\n"); return 1; } xdr_destroy(&xdrs); free(string); return 0; } >Fix: The routine should probably check if (sp == NULL), and in that case just return(FALSE); >Release-Note: >Audit-Trail: >Unformatted: