[arch-commits] Commit in rpcbind/trunk (PKGBUILD bug-940191.patch)

[Andreas Radke]

    Date: Saturday, September 19, 2015 @ 18:58:35
  Author: andyrtr
Revision: 246665

upgpkg: rpcbind 0.2.3-2

fix a memory corruption crash - FS#46341

Added:
  rpcbind/trunk/bug-940191.patch
Modified:
  rpcbind/trunk/PKGBUILD

------------------+
 PKGBUILD         |    9 +++++
 bug-940191.patch |   80 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 88 insertions(+), 1 deletion(-)

Modified: PKGBUILD
===================================================================
--- PKGBUILD	2015-09-19 16:53:03 UTC (rev 246664)
+++ PKGBUILD	2015-09-19 16:58:35 UTC (rev 246665)
@@ -4,7 +4,7 @@
 
 pkgname=rpcbind
 pkgver=0.2.3
-pkgrel=1
+pkgrel=2
 pkgdesc="portmap replacement which supports RPC over various protocols"
 arch=(i686 x86_64)
 backup=('etc/conf.d/rpcbind')
@@ -15,6 +15,7 @@
 replaces=('portmap')
 # see also http://git.infradead.org/users/steved/rpcbind.git
 source=(http://downloads.sourceforge.net/sourceforge/$pkgname/$pkgname-$pkgver.tar.bz2
+        bug-940191.patch
         rpcbind-sunrpc.patch
         rpcbind.service
         rpcbind.socket
@@ -21,6 +22,7 @@
         rpcbind.conf)
 install=rpcbind.install
 sha1sums=('e79974a99d09b6d6fff9d86bf00225dc33723ce2'
+          '717e2700510b1b40f452eddb929a7be00df4292b'
           '1b997ce76f9727efc8c72fc5f97189591c9a60e2'
           '3534c7bcdecebda90182fe2328a16137353cb1ad'
           'c52f8396cd05181b788fbdf74898730343c03c9a'
@@ -30,6 +32,11 @@
   cd $srcdir/$pkgname-$pkgver
   # patch for iana services file # FS#20273
   patch -Np1 -i ../rpcbind-sunrpc.patch
+  
+  # fix a memory corruption crash when remote scanning
+  # https://bugs.archlinux.org/task/46341
+  # http://seclists.org/oss-sec/2015/q3/581
+  patch -Np1 -i ../bug-940191.patch
 }
 
 build() {

Added: bug-940191.patch
===================================================================
--- bug-940191.patch	                        (rev 0)
+++ bug-940191.patch	2015-09-19 16:58:35 UTC (rev 246665)
@@ -0,0 +1,80 @@
+commit 06f7ebb1dade2f0dbf872ea2bedf17cff4734bdd
+Author: Olaf Kirch <okir () suse de>
+Date:   Thu Aug 6 16:27:20 2015 +0200
+
+    Fix memory corruption in PMAP_CALLIT code
+    
+     - A PMAP_CALLIT call comes in on IPv4 UDP
+     - rpcbind duplicates the caller's address to a netbuf and stores it in
+       FINFO[0].caller_addr. caller_addr->buf now points to a memory region A
+       with a size of 16 bytes
+     - rpcbind forwards the call to the local service, receives a reply
+     - when processing the reply, it does this in xprt_set_caller:
+         xprt->xp_rtaddr = *FINFO[0].caller_addr
+       It sends out the reply, and then frees the netbuf caller_addr and
+       caller_addr.buf.
+       However, it does not clear xp_rtaddr, so xp_rtaddr.buf now refers
+       to memory region A, which is free.
+     - When the next call comes in on the UDP/IPv4 socket, svc_dg_recv will
+       be called, which will set xp_rtaddr to the client's address.
+       It will reuse the buffer inside xp_rtaddr, ie it will write a
+       sockaddr_in to region A
+    
+    Some time down the road, an incoming TCP connection is accepted,
+    allocating a fresh SVCXPRT. The memory region A is inside the
+    new SVCXPRT
+    
+     - While processing the TCP call, another UDP call comes in, again
+       overwriting region A with the client's address
+     - TCP client closes connection. In svc_destroy, we now trip over
+       the garbage left in region A
+    
+    We ran into the case where a commercial scanner was triggering
+    occasional rpcbind segfaults. The core file that was captured showed
+    a corrupted xprt->xp_netid pointer that was really a sockaddr_in.
+    
+    Signed-off-by: Olaf Kirch <okir () suse de>
+
+---
+ src/rpcb_svc_com.c |   23 ++++++++++++++++++++++-
+ 1 file changed, 22 insertions(+), 1 deletion(-)
+
+Index: rpcbind-0.1.6+git20080930/src/rpcb_svc_com.c
+===================================================================
+--- rpcbind-0.1.6+git20080930.orig/src/rpcb_svc_com.c
++++ rpcbind-0.1.6+git20080930/src/rpcb_svc_com.c
+@@ -1298,12 +1298,33 @@ check_rmtcalls(struct pollfd *pfds, int
+ 	return (ncallbacks_found);
+ }
+ 
++/*
++ * This is really a helper function defined in libtirpc, but unfortunately, it hasn't
++ * been exported yet.
++ */
++static struct netbuf *
++__rpc_set_netbuf(struct netbuf *nb, const void *ptr, size_t len)
++{
++	if (nb->len != len) {
++		if (nb->len)
++			mem_free(nb->buf, nb->len);
++		nb->buf = mem_alloc(len);
++		if (nb->buf == NULL)
++			return NULL;
++
++		nb->maxlen = nb->len = len;
++	}
++	memcpy(nb->buf, ptr, len);
++	return nb;
++}
++
+ static void
+ xprt_set_caller(SVCXPRT *xprt, struct finfo *fi)
+ {
++	const struct netbuf *caller = fi->caller_addr;
+ 	u_int32_t *xidp;
+ 
+-	*(svc_getrpccaller(xprt)) = *(fi->caller_addr);
++	__rpc_set_netbuf(svc_getrpccaller(xprt), caller->buf, caller->len);
+ 	xidp = __rpcb_get_dg_xidp(xprt);
+ 	*xidp = fi->caller_xid;
+ }