From 9d1aeb5d761581a35bef2042e9116b96e9ae3bf5 Mon Sep 17 00:00:00 2001 From: Mark Vitale Date: Tue, 26 Jun 2018 03:37:37 -0400 Subject: [PATCH] OPENAFS-SA-2018-002 ptserver: prevent PR_ListEntries information leak PR_ListEntries (pts listentries) does not properly initialize its output buffers. This leaks ptserver memory over the wire: struct prlistentries - up to 62 bytes for each entry name (PR_MAXNAMELEN 64 - 'a\0') Initialize the buffer, and remove the now redundant memset for the reserved fields. Change-Id: I29d70c7e4dd567b8b046037f29f71911b8a0593f --- src/ptserver/ptprocs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/ptserver/ptprocs.c b/src/ptserver/ptprocs.c index 5e66fdf773..4ce1cbf92f 100644 --- a/src/ptserver/ptprocs.c +++ b/src/ptserver/ptprocs.c @@ -1538,6 +1538,7 @@ put_prentries(struct prentry *tentry, prentries *bulkentries) entry = bulkentries->prentries_val; entry += bulkentries->prentries_len; + memset(entry, 0, sizeof(*entry)); entry->flags = tentry->flags >> PRIVATE_SHIFT; if (entry->flags == 0) { entry->flags = @@ -1552,7 +1553,6 @@ put_prentries(struct prentry *tentry, prentries *bulkentries) entry->nusers = tentry->nusers; entry->count = tentry->count; strncpy(entry->name, tentry->name, PR_MAXNAMELEN); - memset(entry->reserved, 0, sizeof(entry->reserved)); bulkentries->prentries_len++; return 0; }