From patchwork Mon Aug 17 09:43:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Weimer X-Patchwork-Id: 141527 X-Patchwork-Delegate: carlos@redhat.com Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 882294BA23C1 for ; Mon, 17 Aug 2026 09:44:24 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 882294BA23C1 Authentication-Results: sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=ieb1S47P X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTP id B860D4BA2E04 for ; Mon, 17 Aug 2026 09:43:52 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org B860D4BA2E04 Authentication-Results: sourceware.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org B860D4BA2E04 Authentication-Results: sourceware.org; arc=none smtp.remote-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1786959832; cv=none; b=e9obNKJ5jlVU3v/2rSpGmSdFWJ5GOos7tC6fBLRdzMKZtdaFMrosUe8FTicmE1BIjXYhMpmkB27JcdRYq/S7L4+fgQo7/afq1yOlGaHRt55QCMxCJkTSQNAHKVgK2rB+L1AtMjdqX8SM4+er8ZcSgYEW+sDkS+M2To1Aa3X9eoc= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1786959832; c=relaxed/simple; bh=p2bllfiSSWHE7SfExjNWUMQBMQBXN8qwlSQEG5MWzu4=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=laBUeAYi4qOWc0A/aPl/CAM89tYuwOpDZXlaPIq3f1HjspgQBcn0N9u1hyuBanuxZEwqn9TVXR/v/hfs2SoTchmu+lnDC0eXDLwq0xvOJD4dqd9GPiZtgs6Uthkqu0XhsEXoIdRJfmjluOm+g+fv+f9JB+ad737jnMSce9fZ+tA= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=ieb1S47P DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org B860D4BA2E04 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1786959832; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type; bh=hnimuoIHd1oJMhYUMI6d2L+giLWBr5Z+tC3fBPjtNoo=; b=ieb1S47PYgytaQZW8t2oHh7kx1VD+5sPoakRyGVMl/c/+mx+kqenbOnkU8aVV9w760Qhoa C7RGTvXiUjBhbW3HAmF3+6Pdb/mBZVsYb3t4tJfjVEm/QqNnbiz/YUhMbd1eSrJZs/j5wj fJkrRbzHos4Mmzla5aA4ElppM9BDu9I= Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-202-gDUAFhLiOf2cSEi5jX-oFw-1; Mon, 17 Aug 2026 05:43:50 -0400 X-MC-Unique: gDUAFhLiOf2cSEi5jX-oFw-1 X-Mimecast-MFC-AGG-ID: gDUAFhLiOf2cSEi5jX-oFw_1786959829 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 2506A19560AB for ; Mon, 17 Aug 2026 09:43:49 +0000 (UTC) Received: from fweimer-oldenburg.csb.redhat.com (headnet03.pony-001.prod.iad2.dc.redhat.com [10.2.32.114]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 5D985195608A for ; Mon, 17 Aug 2026 09:43:48 +0000 (UTC) From: Florian Weimer To: libc-alpha@sourceware.org Subject: [PATCH] nis: Fix stack overflow (stack exhaustion) in yp_all (bug 34528) Date: Mon, 17 Aug 2026 11:43:45 +0200 Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: fqaWimurc2aoVCwvdCICo5Qfnl2r7FhRdKV9mwnNFH8_1786959829 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-9.4 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL, RCVD_IN_SBL_CSS, SPF_HELO_PASS, SPF_NONE, TXREP shortcircuit=no autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces~patchwork=sourceware.org@sourceware.org The fix relies on the XDRMAXRECORD limit imposed in yp_xdr.c. The bug was present from the beginning. --- nis/ypclnt.c | 33 +++++++++++++++++++++++---------- 1 file changed, 23 insertions(+), 10 deletions(-) base-commit: 6144ef08960e1db191db2054abef02d361042018 diff --git a/nis/ypclnt.c b/nis/ypclnt.c index 455d80df1f..83bafb5151 100644 --- a/nis/ypclnt.c +++ b/nis/ypclnt.c @@ -685,23 +685,36 @@ __xdr_ypresp_all (XDR *xdrs, struct ypresp_all_data *objp) { case YP_TRUE: { - char key[resp.ypresp_all_u.val.key.keydat_len + 1]; - char val[resp.ypresp_all_u.val.val.valdat_len + 1]; - int keylen = resp.ypresp_all_u.val.key.keydat_len; - int vallen = resp.ypresp_all_u.val.val.valdat_len; /* We are not allowed to modify the key and val data. But we are allowed to add data behind the buffer, if we don't modify the length. So add an extra NUL character to avoid trouble with broken code. */ + + size_t keylen = resp.ypresp_all_u.val.key.keydat_len; + size_t vallen = resp.ypresp_all_u.val.val.valdat_len; + /* Cannot overflow due to the XDRMAXRECORD limit in yp_xdr.c. */ + size_t keyval_size = keylen + vallen + 2; + char *buffer = malloc (keyval_size); + if (buffer == NULL) + { + xdr_free ((xdrproc_t) xdr_ypresp_all, (char *) &resp); + objp->status = YP_YPERR; + return FALSE; + } + objp->status = YP_TRUE; - *((char *) __mempcpy (key, resp.ypresp_all_u.val.key.keydat_val, - keylen)) = '\0'; - *((char *) __mempcpy (val, resp.ypresp_all_u.val.val.valdat_val, - vallen)) = '\0'; + buffer[keylen] = '\0'; + buffer[keyval_size - 1] = '\0'; + char *val = buffer + keylen + 1; + memcpy (buffer, resp.ypresp_all_u.val.key.keydat_val, keylen); + memcpy (val, resp.ypresp_all_u.val.val.valdat_val, vallen); xdr_free ((xdrproc_t) xdr_ypresp_all, (char *) &resp); - if ((*objp->foreach) (objp->status, key, keylen, - val, vallen, objp->data)) + + bool ok = (*objp->foreach) (objp->status, buffer, keylen, + val, vallen, objp->data); + free (buffer); + if (ok) return TRUE; } break;