aboutsummaryrefslogtreecommitdiff
path: root/sunrpc
diff options
context:
space:
mode:
authorFlorian Weimer <fweimer@redhat.com>2022-01-17 10:21:34 +0100
committerFlorian Weimer <fweimer@redhat.com>2022-01-17 10:22:00 +0100
commit226b46770c82899b555986583294b049c6ec9b40 (patch)
tree2112b32dabd8b2f33ead4ef15eef34705ff04b98 /sunrpc
parente368b12f6c16b6888dda99ba641e999b9c9643c8 (diff)
downloadglibc-226b46770c82899b555986583294b049c6ec9b40.zip
glibc-226b46770c82899b555986583294b049c6ec9b40.tar.gz
glibc-226b46770c82899b555986583294b049c6ec9b40.tar.bz2
CVE-2022-23219: Buffer overflow in sunrpc clnt_create for "unix" (bug 22542)
Processing an overlong pathname in the sunrpc clnt_create function results in a stack-based buffer overflow. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Diffstat (limited to 'sunrpc')
-rw-r--r--sunrpc/clnt_gen.c10
1 files changed, 7 insertions, 3 deletions
diff --git a/sunrpc/clnt_gen.c b/sunrpc/clnt_gen.c
index 13ced89..b44357c 100644
--- a/sunrpc/clnt_gen.c
+++ b/sunrpc/clnt_gen.c
@@ -57,9 +57,13 @@ clnt_create (const char *hostname, u_long prog, u_long vers,
if (strcmp (proto, "unix") == 0)
{
- memset ((char *)&sun, 0, sizeof (sun));
- sun.sun_family = AF_UNIX;
- strcpy (sun.sun_path, hostname);
+ if (__sockaddr_un_set (&sun, hostname) < 0)
+ {
+ struct rpc_createerr *ce = &get_rpc_createerr ();
+ ce->cf_stat = RPC_SYSTEMERROR;
+ ce->cf_error.re_errno = errno;
+ return NULL;
+ }
sock = RPC_ANYSOCK;
client = clntunix_create (&sun, prog, vers, &sock, 0, 0);
if (client == NULL)