Bug 848748

Description of problem:
This issue has been found during analysing of bug #845283.

Let's have NIS client and server configured. glibc's functions like yp_match then send UDP packets to NIS server to ask for network information like login names, passwords etc. Requests are byte strings containing e.g. "...<domainname length><domainname string>...".

When we change length field of the xdr request, while the rest of the string is unchanged and pass such malformed request to the ypserv daemon for example, glibc routine allocates huge memory and then tries to read huge amount of such unallocated memory.

ypserv has a bug #845283, that causes not freeing memory when request is not parsed properly, which results in huge memory leaks and daemon failure. While freeing memory after failed parsing has to be fixed in ypserv, glibc should prevent such behaviour and not allocate more memory than necessary to avoid reading unallocated memory.

There are already limits for NIS fields like domainname, mapname, etc., but they're not used in the parsing functions. Valgrind prints then the following error:

==16566== Conditional jump or move depends on uninitialised value(s)
==16566==    at 0x4A077F9: __GI_strlen (mc_replace_strmem.c:284)
==16566==    by 0x51587F6: xdr_string (xdr.c:680)
==16566==    by 0x4E2D5AD: xdr_ypreq_key (yp_xdr.c:50)
==16566==    by 0x10B092: ypprog_2 (ypserv.c:222)
==16566==    by 0x5156398: svc_getreq_common (svc.c:485)
==16566==    by 0x5155ED0: svc_getreq_poll (svc.c:415)
==16566==    by 0x5156A02: svc_run (svc_run.c:94)
==16566==    by 0x10B84C: main (ypserv.c:726)

Using the following sane limits to NIS fields should prevent such behaviour:
#define YPMAXRECORD 1024
#define YPMAXDOMAIN 64
#define YPMAXMAP 64
#define YPMAXPEER 64


Version-Release number of selected component (if applicable):
glibc-2.12-1.80.el6.x86_64

How reproducible:
every-time

Steps to Reproduce:
1. start ypserv daemon
2. configure ypbind to use that ypserv daemon
3. create a malformed request string (example of such request will be attached as ypserv-packet-bin)
4. cat ypserv-packet-bin |nc -u 192.168.122.70 811 (192.168.122.70:811 is where ypserv listens for UDP requests)

  
Actual results:
huge amount of memory is allocated and then uninitialized memory is read during parsing request

Expected results:
amount of memory allocated during request parsing is limited to a sane amount