Bug 1600284
| Summary: | Integer overflows in clnt_vc_create and clnt_dg_create | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | jmenon | ||||
| Component: | libtirpc | Assignee: | Steve Dickson <steved> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | rawhide | CC: | jlayton, jmenon, steved | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | i386 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | libtirpc-1.0.3-2.rc2.fc28 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2018-07-24 17:29:45 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Could you please post your patch to Libtirpc-devel Mailing List <libtirpc-devel.net> and cc-ing to Linux NFS Mailing list <linux-nfs.org> mailing list? Just to get more eyes on it... Try using the git send-email command to post the emails https://sourceforge.net/p/libtirpc/mailman/message/36366607/ Thank you! If there is no push back I'll try to make it happen... libtirpc-1.0.3-2.rc2.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-1c9ca7b068 libtirpc-1.0.3-2.rc2.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-1c9ca7b068 libtirpc-1.0.3-2.rc2.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report. |
Created attachment 1458228 [details] A git format-patch output which describes the changes that can fix this issue. Description of problem: There exits a possibility of an integer overflow in the clnt_vc_create @ src/clnt_vc.c : 217 and clnt_dg_create @ src/clnt_dg.c : 176. In clnt_dg_create, the integer dtbsize is multiplied with the size of the cond_t structure to get the total number of bytes to be allocated. The integer dtbsize is the value returned by a call to __rpc_dtbsize. 163: int cv_allocsz; 164: size_t fd_allocsz; 165: int dtbsize = __rpc_dtbsize(); 176: cv_allocsz = dtbsize * sizeof (cond_t); On a 32 bit version, the integer dtbsize is multiplied with the value 48. The value returned by __rpc_dtbsize is the hard limit on the maximum number of file descriptors which is 2^20 by default in my Ubuntu 16.04. If this hard limit was increased to a value greater than 2^27, this multiplication would overflow and result in a value smaller than the expected size. I understand that changing the hard limit on the maximum value of file descriptors requires root privilege. But it would be reasonable to double check this value before using it in calculations. I've uploaded a sample patch to fix this issue. I hope it conforms to the specifications of the library. Please investigate this issue.