jimzah/openafs
1
0
Fork 0
mirror of https://git.openafs.org/openafs.git synced 2025-01-31 05:27:44 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

OPENAFS-SA-2018-002 ptserver: prevent PR_ListEntries information leak

Browse Source 
PR_ListEntries (pts listentries) does not properly initialize its output
buffers.  This leaks ptserver memory over the wire:

struct prlistentries
- up to 62 bytes for each entry name (PR_MAXNAMELEN 64 - 'a\0')

Initialize the buffer, and remove the now redundant memset for the
reserved fields.

(cherry picked from commit 9d1aeb5d761581a35bef2042e9116b96e9ae3bf5)

Change-Id: I679c205502941891cbb34f10e648a6f9d83c3c60
This commit is contained in:
Mark Vitale 2018-06-26 03:37:37 -04:00 committed by Benjamin Kaduk
parent 2d22756de7
commit e19ad4cdde
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/ptserver/ptprocs.c
View File

@ -1538,6 +1538,7 @@ put_prentries(struct prentry *tentry, prentries *bulkentries)
entry = bulkentries->prentries_val; entry = bulkentries->prentries_val;
entry += bulkentries->prentries_len; entry += bulkentries->prentries_len;
memset(entry, 0, sizeof(*entry));
entry->flags = tentry->flags >> PRIVATE_SHIFT; entry->flags = tentry->flags >> PRIVATE_SHIFT;
if (entry->flags == 0) { if (entry->flags == 0) {
entry->flags = entry->flags =
@ -1552,7 +1553,6 @@ put_prentries(struct prentry *tentry, prentries *bulkentries)
entry->nusers = tentry->nusers; entry->nusers = tentry->nusers;
entry->count = tentry->count; entry->count = tentry->count;
strncpy(entry->name, tentry->name, PR_MAXNAMELEN); strncpy(entry->name, tentry->name, PR_MAXNAMELEN);
memset(entry->reserved, 0, sizeof(entry->reserved));
bulkentries->prentries_len++; bulkentries->prentries_len++;
return 0; return 0;
} }