Skip to content

Commit

Permalink
svcrpc: fix gss-proxy xdr decoding oops
Browse files Browse the repository at this point in the history
Uninitialized stack data was being used as the destination for memcpy's.

Longer term we'll just delete some of this code; all we're doing is
skipping over xdr that we don't care about.

Cc: stable@vger.kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
  • Loading branch information
J. Bruce Fields committed Aug 1, 2013
1 parent 9f96392 commit dc43376
Showing 1 changed file with 5 additions and 4 deletions.
9 changes: 5 additions & 4 deletions net/sunrpc/auth_gss/gss_rpc_xdr.c
Original file line number Diff line number Diff line change
Expand Up @@ -430,7 +430,7 @@ static int dummy_enc_nameattr_array(struct xdr_stream *xdr,
static int dummy_dec_nameattr_array(struct xdr_stream *xdr,
struct gssx_name_attr_array *naa)
{
struct gssx_name_attr dummy;
struct gssx_name_attr dummy = { .attr = {.len = 0} };
u32 count, i;
__be32 *p;

Expand Down Expand Up @@ -493,12 +493,13 @@ static int gssx_enc_name(struct xdr_stream *xdr,
return err;
}


static int gssx_dec_name(struct xdr_stream *xdr,
struct gssx_name *name)
{
struct xdr_netobj dummy_netobj;
struct gssx_name_attr_array dummy_name_attr_array;
struct gssx_option_array dummy_option_array;
struct xdr_netobj dummy_netobj = { .len = 0 };
struct gssx_name_attr_array dummy_name_attr_array = { .count = 0 };
struct gssx_option_array dummy_option_array = { .count = 0 };
int err;

/* name->display_name */
Expand Down

0 comments on commit dc43376

Please sign in to comment.