From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from hall.aurel32.net (hall.aurel32.net [IPv6:2001:bc8:30d7:100::1]) by sourceware.org (Postfix) with ESMTPS id A596A3858006; Tue, 18 Jan 2022 06:49:32 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org A596A3858006 Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=aurel32.net Authentication-Results: sourceware.org; spf=none smtp.mailfrom=aurel32.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=aurel32.net ; s=202004.hall; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Content-Type:From:Reply-To: Subject:Content-ID:Content-Description:X-Debbugs-Cc; bh=S3pmyFnirJXvW+zQ7mqaLIlJqnSDIztbpqRWDoRQUFw=; b=PWgzW11/6Ov8gs3laA7HGEhqaN cTAF5gLJuIvuroOS0vg984jkQDBQktoVcR9X2P4sOmPTyOlPsxiIHHlIYNJojxGKsdH6oUzVEp81i RzkNMyhpRSQbaffLH2EbNjIt4m9fY8f7oSxGzSzDHq8mDX9+DzfmvaMQFVgmfZB3j8uWx7Oo5cxf7 QmAPGVoodqHFmqv7i2rLOLSUQ0hZ4WdnvWC0qI+3dT9xHqr58Sl3YYhQdRCOaFovgFJDXNbwBFV1V iIE8Qz12oz66gfhIN3Q+Pcv95Lb7I7IlgNdjMHy7cuivYcX26O0TAk3MRBxOMQDQPU0sRupXjquh1 wbJiwvVw==; Received: from [2a01:e34:ec5d:a741:8a4c:7c4e:dc4c:1787] (helo=ohm.rr44.fr) by hall.aurel32.net with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1n9iJ9-00AmHv-Iw; Tue, 18 Jan 2022 07:49:31 +0100 Received: from aurel32 by ohm.rr44.fr with local (Exim 4.95) (envelope-from ) id 1n9iJ9-004ryR-7C; Tue, 18 Jan 2022 07:49:31 +0100 From: Aurelien Jarno To: libc-stable@sourceware.org Cc: Martin Sebor , Siddhesh Poyarekar Subject: [COMMITTED 2.33 3/3] sunrpc: Test case for clnt_create "unix" buffer overflow (bug 22542) Date: Tue, 18 Jan 2022 07:49:26 +0100 Message-Id: <20220118064926.1160592-3-aurelien@aurel32.net> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220118064926.1160592-1-aurelien@aurel32.net> References: <20220118064926.1160592-1-aurelien@aurel32.net> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-12.4 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, KAM_SHORT, SPF_HELO_PASS, SPF_NONE, TXREP, URIBL_BLACK autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: libc-stable@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-stable mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Jan 2022 06:49:34 -0000 From: Martin Sebor Reviewed-by: Siddhesh Poyarekar (cherry picked from commit ef972a4c50014a16132b5c75571cfb6b30bef136) --- sunrpc/Makefile | 5 ++++- sunrpc/tst-bug22542.c | 44 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 48 insertions(+), 1 deletion(-) create mode 100644 sunrpc/tst-bug22542.c diff --git a/sunrpc/Makefile b/sunrpc/Makefile index 9761585409..b0fab5d818 100644 --- a/sunrpc/Makefile +++ b/sunrpc/Makefile @@ -65,7 +65,8 @@ shared-only-routines = $(routines) endif tests = tst-xdrmem tst-xdrmem2 test-rpcent tst-udp-error tst-udp-timeout \ - tst-udp-nonblocking + tst-udp-nonblocking tst-bug22542 + xtests := tst-getmyaddr ifeq ($(have-thread-library),yes) @@ -111,6 +112,8 @@ $(objpfx)tst-udp-nonblocking: $(common-objpfx)linkobj/libc.so $(objpfx)tst-udp-garbage: \ $(common-objpfx)linkobj/libc.so $(shared-thread-library) +$(objpfx)tst-bug22542: $(common-objpfx)linkobj/libc.so + else # !have-GLIBC_2.31 routines = $(routines-for-nss) diff --git a/sunrpc/tst-bug22542.c b/sunrpc/tst-bug22542.c new file mode 100644 index 0000000000..d6cd79787b --- /dev/null +++ b/sunrpc/tst-bug22542.c @@ -0,0 +1,44 @@ +/* Test to verify that overlong hostname is rejected by clnt_create + and doesn't cause a buffer overflow (bug 22542). + + Copyright (C) 2022 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include +#include +#include +#include +#include + +static int +do_test (void) +{ + /* Create an arbitrary hostname that's longer than fits in sun_path. */ + char name [sizeof ((struct sockaddr_un*)0)->sun_path * 2]; + memset (name, 'x', sizeof name - 1); + name [sizeof name - 1] = '\0'; + + errno = 0; + CLIENT *clnt = clnt_create (name, 0, 0, "unix"); + + TEST_VERIFY (clnt == NULL); + TEST_COMPARE (errno, EINVAL); + return 0; +} + +#include -- 2.34.1