[src/trunk]: src/lib/libc/rpc PR/44132: Wolfgang Stukenbrock: libc/rpc may ov...

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/8f194f1404ba
branches:  trunk
changeset: 759000:8f194f1404ba
user:      christos <christos%NetBSD.org@localhost>
date:      Tue Nov 23 14:02:01 2010 +0000

description:
PR/44132: Wolfgang Stukenbrock: libc/rpc may overwrite not-allocated memory
Return XPRT_DIED when realloc fails for lack of a better error.

diffstat:

 lib/libc/rpc/xdr_rec.c |  12 ++++++++----
 1 files changed, 8 insertions(+), 4 deletions(-)

diffs (33 lines):

diff -r db025db741fe -r 8f194f1404ba lib/libc/rpc/xdr_rec.c
--- a/lib/libc/rpc/xdr_rec.c    Tue Nov 23 12:51:10 2010 +0000
+++ b/lib/libc/rpc/xdr_rec.c    Tue Nov 23 14:02:01 2010 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: xdr_rec.c,v 1.30 2009/02/12 04:40:40 lukem Exp $       */
+/*     $NetBSD: xdr_rec.c,v 1.31 2010/11/23 14:02:01 christos Exp $    */
 
 /*
  * Sun RPC is a product of Sun Microsystems, Inc. and is provided for
@@ -35,7 +35,7 @@
 static char *sccsid = "@(#)xdr_rec.c 1.21 87/08/11 Copyr 1984 Sun Micro";
 static char *sccsid = "@(#)xdr_rec.c   2.2 88/08/01 4.0 RPCSRC";
 #else
-__RCSID("$NetBSD: xdr_rec.c,v 1.30 2009/02/12 04:40:40 lukem Exp $");
+__RCSID("$NetBSD: xdr_rec.c,v 1.31 2010/11/23 14:02:01 christos Exp $");
 #endif
 #endif
 
@@ -581,8 +581,12 @@
                        return FALSE;
                }
                rstrm->in_reclen += fraglen;
-               if ((u_int)rstrm->in_reclen > rstrm->recvsize)
-                       realloc_stream(rstrm, rstrm->in_reclen);
+               if ((u_int)rstrm->in_reclen > rstrm->recvsize) {
+                       if (!realloc_stream(rstrm, rstrm->in_reclen)) {
+                               *statp = XPRT_DIED;
+                               return FALSE;
+                       }
+               }
                if (rstrm->in_header & LAST_FRAG) {
                        rstrm->in_header &= ~LAST_FRAG;
                        rstrm->last_frag = TRUE;