Bug 172576
| Summary: | [librpc] librpc segfaults when out of memory | ||
|---|---|---|---|
| Product: | Base System | Reporter: | Ritesh Shah <ritesh_shah2000> |
| Component: | kern | Assignee: | freebsd-bugs (Nobody) <bugs> |
| Status: | Open --- | ||
| Severity: | Affects Only Me | ||
| Priority: | Normal | ||
| Version: | Unspecified | ||
| Hardware: | Any | ||
| OS: | Any | ||
For bugs matching the following criteria: Status: In Progress Changed: (is less than) 2014-06-01 Reset to default assignee and clear in-progress tags. Mail being skipped |
xdrrec_create() routine in lib/libc/xdr/xdr_rec.c returns a void. Under low memory condition this routine can bail out early and leave part of the XDR structrure uninitialized. The callers : clnt_vc_create() in lib/libc/rpc/clnt_vc.c & makefd_xprt() in lib/libc/rpc/svc_vc.c do not check whether failed or not. This can lead to segfault when uninitialized pointers are accessed. This bug exists in FreeBSD 9 as well. 192 rstrm->in_base = mem_alloc(recvsize); 193 if (rstrm->in_base == NULL) { 194 warnx("xdrrec_create: out of memory"); 195 mem_free(rstrm->out_base, sendsize); 196 mem_free(rstrm, sizeof(RECSTREAM)); 197 return; 198 } 199 /* 200 * now the rest ... 201 */ 202 xdrs->x_ops = &xdrrec_ops; 203 xdrs->x_private = rstrm; 204 rstrm->tcp_handle = tcp_handle; Fix: It has been reported against netbsd as well. http://mail-index.netbsd.org/netbsd-bugs/2012/08/06/msg029375.html I can provide a patch if there is an agreement on how it should be fixed.