amaharaneko/guix-mirrors
1
1
Fork 0
mirror of https://codeberg.org/guix/guix.git synced 2025-10-02 02:15:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

gnu: rpcbind, libtirpc: Fix CVE-2017-8779.

Browse source 
* gnu/packages/patches/libtirpc-CVE-2017-8779.patch,
gnu/packages/patches/rpcbind-CVE-2017-8779.patch: New files.
* gnu/local.mk (dist_patch_DATA): Add them.
* gnu/packages/onc-rpc.scm (rpcbind, libtirpc)[source]: Use them.
This commit is contained in:
Leo Famulari 2017-05-04 21:26:03 -04:00
parent 2beb879b4b
commit c39a54f431
No known key found for this signature in database
GPG key ID: 2646FA30BACA7F08
4 changed files with 297 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

29
gnu/packages/patches/rpcbind-CVE-2017-8779.patch Normal file
View file

@ -0,0 +1,29 @@
Fix CVE-2017-8779:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8779
Patch copied from the bug reporter's 3rd-party repository:
https://github.com/guidovranken/rpcbomb/blob/master/rpcbind_patch.txt
diff --git a/src/rpcb_svc_com.c b/src/rpcb_svc_com.c
index 5862c26..e11f61b 100644
--- a/src/rpcb_svc_com.c
+++ b/src/rpcb_svc_com.c
@@ -48,6 +48,7 @@
#include <rpc/rpc.h>
#include <rpc/rpcb_prot.h>
#include <rpc/svc_dg.h>
+#include <rpc/rpc_com.h>
#include <netconfig.h>
#include <errno.h>
#include <syslog.h>
@@ -432,7 +433,7 @@ rpcbproc_taddr2uaddr_com(void *arg, struct svc_req *rqstp /*__unused*/,
static bool_t
xdr_encap_parms(XDR *xdrs, struct encap_parms *epp)
{
- return (xdr_bytes(xdrs, &(epp->args), (u_int *) &(epp->arglen), ~0));
+ return (xdr_bytes(xdrs, &(epp->args), (u_int *) &(epp->arglen), RPC_MAXDATASIZE));
}
/*