Created attachment 1458228 [details]
A git format-patch output which describes the changes that can fix this issue.

Description of problem:

There exits a possibility of an integer overflow in the clnt_vc_create @ src/clnt_vc.c : 217 and clnt_dg_create @ src/clnt_dg.c : 176.

In clnt_dg_create, the integer dtbsize is multiplied with the size of the cond_t structure to get the total number of bytes to be allocated.

The integer dtbsize is the value returned by a call to __rpc_dtbsize.

163: int cv_allocsz;
164: size_t fd_allocsz;
165: int dtbsize = __rpc_dtbsize();

176: cv_allocsz = dtbsize * sizeof (cond_t);

On a 32 bit version, the integer dtbsize is multiplied with the value 48.
The value returned by __rpc_dtbsize is the hard limit on the maximum number of file descriptors which is 2^20 by default in my Ubuntu 16.04.

If this hard limit was increased to a value greater than 2^27, this multiplication would overflow and result in a value smaller than the expected size.

I understand that changing the hard limit on the maximum value of file descriptors requires root privilege. But it would be reasonable to double check this value before using it in calculations.

I've uploaded a sample patch to fix this issue. I hope it conforms to the specifications of the library.

Please investigate this issue.