From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <libc-hacker-return-7656-listarch-libc-hacker=sources.redhat.com@sources.redhat.com>
Received: (qmail 20719 invoked by alias); 14 Jun 2004 13:15:12 -0000
Mailing-List: contact libc-hacker-help@sources.redhat.com; run by ezmlm
Precedence: bulk
List-Subscribe: <mailto:libc-hacker-subscribe@sources.redhat.com>
List-Archive: <http://sources.redhat.com/ml/libc-hacker/>
List-Post: <mailto:libc-hacker@sources.redhat.com>
List-Help: <mailto:libc-hacker-help@sources.redhat.com>, <http://sources.redhat.com/ml/#faqs>
Sender: libc-hacker-owner@sources.redhat.com
Received: (qmail 20691 invoked from network); 14 Jun 2004 13:15:11 -0000
Received: from unknown (HELO sunsite.ms.mff.cuni.cz) (195.113.15.26)
  by sourceware.org with SMTP; 14 Jun 2004 13:15:11 -0000
Received: from sunsite.ms.mff.cuni.cz (sunsite.mff.cuni.cz [127.0.0.1])
	by sunsite.ms.mff.cuni.cz (8.12.8/8.12.8) with ESMTP id i5EB0l3j032434;
	Mon, 14 Jun 2004 13:00:47 +0200
Received: (from jakub@localhost)
	by sunsite.ms.mff.cuni.cz (8.12.8/8.12.8/Submit) id i5EB0h2S032393;
	Mon, 14 Jun 2004 13:00:43 +0200
Date: Mon, 14 Jun 2004 13:15:00 -0000
From: Jakub Jelinek <jakub@redhat.com>
To: Ulrich Drepper <drepper@redhat.com>, Roland McGrath <roland@redhat.com>
Cc: Glibc hackers <libc-hacker@sources.redhat.com>, kimdon@esrf.fr
Subject: [PATCH] Fix BZ #218
Message-ID: <20040614110041.GT5191@sunsite.ms.mff.cuni.cz>
Reply-To: Jakub Jelinek <jakub@redhat.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.4i
X-SW-Source: 2004-06/txt/msg00024.txt.bz2

Hi!

By saving address of pml_next we actually did not help ourselves at all,
next still points into freed memory after xdr_reference and thus cannot be
read nor written.
The patch in bugzilla doesn't help much, it adds to a read from freed
memory in xdr_reference also a write into freed memory.

2004-06-14  Jakub Jelinek  <jakub@redhat.com>

	[BZ #218]
	* sunrpc/pmap_prot2.c (xdr_pmaplist): When freeing, remember pml_next
	in a local variable, point rp to that local variable afterwards.

--- libc/sunrpc/pmap_prot2.c.jj	2002-02-26 02:43:56.000000000 +0100
+++ libc/sunrpc/pmap_prot2.c	2004-06-14 15:01:45.489088043 +0200
@@ -93,7 +93,7 @@ xdr_pmaplist (xdrs, rp)
    */
   bool_t more_elements;
   int freeing = (xdrs->x_op == XDR_FREE);
-  struct pmaplist **next = NULL;
+  struct pmaplist *next = NULL;
 
   while (TRUE)
     {
@@ -108,12 +108,12 @@ xdr_pmaplist (xdrs, rp)
        * before we free the current object ...
        */
       if (freeing)
-	next = &((*rp)->pml_next);
+	next = (*rp)->pml_next;
       if (!INTUSE(xdr_reference) (xdrs, (caddr_t *) rp,
 				  (u_int) sizeof (struct pmaplist),
 				  (xdrproc_t) INTUSE(xdr_pmap)))
 	  return FALSE;
-      rp = freeing ? next : &((*rp)->pml_next);
+      rp = freeing ? &next : &((*rp)->pml_next);
     }
 }
 INTDEF(xdr_pmaplist)

	Jakub