glibc/include/rpc/svc.h
Stefan Liebler 4b2e40a925 Handle out-of-memory case in svc_tcp.c/svc_unix.c:rendezvous_request.
If glibc is build with -O3 on at least 390 (-m31) or x86 (-m32),
gcc 11 dumps this warning:
svc_tcp.c: In function 'rendezvous_request':
svc_tcp.c:274:3: error: 'memcpy' offset [0, 15] is out of the bounds [0, 0] [-Werror=array-bounds]
  274 |   memcpy (&xprt->xp_raddr, &addr, sizeof (addr));
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors

In out-of-memory case, if one of the mallocs in makefd_xprt function
returns NULL, a message is dumped, makefd_xprt returns NULL
and the subsequent memcpy would copy to NULL.

Instead of a segfaulting, we delay a bit (see also __svc_accept_failed
and Bug 14889 (CVE-2011-4609) - svc_run() produces high cpu usage when
accept() fails with EMFILE (CVE-2011-4609).

The same applies to svc_unix.c.
Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
2020-12-10 11:11:20 +01:00

45 lines
1.3 KiB
C

#ifndef _RPC_SVC_H
#include <sunrpc/rpc/svc.h>
# ifndef _ISOMAC
libc_hidden_proto (xprt_register)
libc_hidden_proto (xprt_unregister)
libc_hidden_proto (svc_register)
libc_hidden_proto (svc_unregister)
libc_hidden_proto (svcerr_auth)
libc_hidden_proto (svcerr_noprog)
libc_hidden_proto (svcerr_progvers)
/* Now define the internal interfaces. */
extern SVCXPRT *svcfd_create (int fd, u_int sendsize, u_int recvsize);
extern int svcudp_enablecache (SVCXPRT *transp, u_long size);
extern SVCXPRT *svcunixfd_create (int fd, u_int sendsize, u_int recvsize);
libc_hidden_proto (svc_exit)
libc_hidden_proto (svc_getreq)
libc_hidden_proto (svc_getreqset)
libc_hidden_proto (svc_run)
libc_hidden_proto (svc_sendreply)
libc_hidden_proto (svcerr_decode)
libc_hidden_proto (svcerr_noproc)
libc_hidden_proto (svcerr_systemerr)
libc_hidden_proto (svcerr_weakauth)
libc_hidden_proto (svcfd_create)
libc_hidden_proto (svcraw_create)
libc_hidden_proto (svctcp_create)
libc_hidden_proto (svcudp_bufcreate)
libc_hidden_proto (svcudp_create)
libc_hidden_proto (svcudp_enablecache)
libc_hidden_proto (svcunix_create)
libc_hidden_proto (svcunixfd_create)
libc_hidden_proto (svc_getreq_common)
libc_hidden_proto (svc_getreq_poll)
extern void __svc_accept_failed (void) attribute_hidden;
extern void __svc_wait_on_error (void) attribute_hidden;
# endif /* !_ISOMAC */
#endif