Bug 141733 - buffer overflow in nfs mount when ip address too long
Summary: buffer overflow in nfs mount when ip address too long
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: util-linux
Version: rawhide
Hardware: i686
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Steve Dickson
QA Contact: Ben Levenson
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2004-12-03 12:41 UTC by Klochan Tibor
Modified: 2007-11-30 22:10 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2005-06-16 09:24:14 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
A patch the increase the input buffer size and protects against further buffer overruns (641 bytes, patch)
2004-12-04 18:15 UTC, Steve Dickson
no flags Details | Diff

Description Klochan Tibor 2004-12-03 12:41:39 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (compatible; Konqueror/3.3; Linux) (KHTML, like Gecko)

Description of problem:
The next comand failed :

mount -t nfs 192.168.168.168:/ /mnt/u



Version-Release number of selected component (if applicable):
util-linux-2.12a-18

How reproducible:
Always

Steps to Reproduce:
1. mount -t nfs 192.168.168.200 /mnt/u

    

Actual Results:  *** buffer overflow detected ***

Aborted (core dumped)


Expected Results:  should mount the nfs directory to the /mnt/u without error message

Additional info:

The problem is in the nfs4 patch, where in the nsfmount subroutine
the declared cbuf size is too small (20 bytes) for longer ip addresses.

FIX: Please increase it.

FIX CHECK: After I increased the cbuf to 128 bytes there was no     problem anymore.

Comment 1 Elliot Lee 2004-12-03 14:12:25 UTC
Steve, this one probably warrants an erratum for affected releases...

Comment 3 Steve Dickson 2004-12-04 18:15:41 UTC
Created attachment 107898 [details]
A patch the increase the input buffer size and protects against further buffer overruns

Comment 4 Steve Dickson 2004-12-04 20:01:49 UTC
Fixed in util-linux-2.12a-19 

Comment 5 Karel Zak 2005-06-16 09:24:14 UTC
Fixed and released. We can close it.


Note You need to log in before you can comment on or make changes to this bug.