diff options
| author | Martin Sebor <msebor@redhat.com> | 2022-01-17 10:21:34 +0100 |
|---|---|---|
| committer | Dmitry V. Levin <ldv@altlinux.org> | 2022-10-04 08:00:00 +0000 |
| commit | 76e807f5f1d264fdb3de4e6ee985ab3cf662f6f9 (patch) | |
| tree | fae3eec863c96447b726bd779c595c64877b104c | |
| parent | 52d57fc76d7df2a39236a782399fb3efff87895d (diff) | |
| download | glibc-76e807f5f1d264fdb3de4e6ee985ab3cf662f6f9.tar.gz glibc-76e807f5f1d264fdb3de4e6ee985ab3cf662f6f9.tar.xz glibc-76e807f5f1d264fdb3de4e6ee985ab3cf662f6f9.zip | |
sunrpc: Test case for clnt_create "unix" buffer overflow (bug 22542)
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> (cherry picked from commit ef972a4c50014a16132b5c75571cfb6b30bef136)
| -rw-r--r-- | sunrpc/Makefile | 5 | ||||
| -rw-r--r-- | sunrpc/tst-bug22542.c | 44 |
2 files changed, 48 insertions, 1 deletions
diff --git a/sunrpc/Makefile b/sunrpc/Makefile index 82710b379a..cea958608e 100644 --- a/sunrpc/Makefile +++ b/sunrpc/Makefile @@ -65,7 +65,8 @@ shared-only-routines = $(routines) endif tests = tst-xdrmem tst-xdrmem2 test-rpcent tst-udp-error tst-udp-timeout \ - tst-udp-nonblocking + tst-udp-nonblocking tst-bug22542 + xtests := tst-getmyaddr ifeq ($(have-thread-library),yes) @@ -111,6 +112,8 @@ $(objpfx)tst-udp-nonblocking: $(common-objpfx)linkobj/libc.so $(objpfx)tst-udp-garbage: \ $(common-objpfx)linkobj/libc.so $(shared-thread-library) +$(objpfx)tst-bug22542: $(common-objpfx)linkobj/libc.so + else # !have-GLIBC_2.31 routines = $(routines-for-nss) diff --git a/sunrpc/tst-bug22542.c b/sunrpc/tst-bug22542.c new file mode 100644 index 0000000000..d6cd79787b --- /dev/null +++ b/sunrpc/tst-bug22542.c @@ -0,0 +1,44 @@ +/* Test to verify that overlong hostname is rejected by clnt_create + and doesn't cause a buffer overflow (bug 22542). + + Copyright (C) 2022 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + <http://www.gnu.org/licenses/>. */ + +#include <errno.h> +#include <rpc/clnt.h> +#include <string.h> +#include <support/check.h> +#include <sys/socket.h> +#include <sys/un.h> + +static int +do_test (void) +{ + /* Create an arbitrary hostname that's longer than fits in sun_path. */ + char name [sizeof ((struct sockaddr_un*)0)->sun_path * 2]; + memset (name, 'x', sizeof name - 1); + name [sizeof name - 1] = '\0'; + + errno = 0; + CLIENT *clnt = clnt_create (name, 0, 0, "unix"); + + TEST_VERIFY (clnt == NULL); + TEST_COMPARE (errno, EINVAL); + return 0; +} + +#include <support/test-driver.c> |