diff options
| author | Andreas Schwab <schwab@suse.de> | 2014-05-08 16:53:01 +0200 |
|---|---|---|
| committer | Andreas Schwab <schwab@suse.de> | 2014-05-12 15:17:51 +0200 |
| commit | 315eb1d86aea489cd6325fd1c2521dcfb4fc0e1c (patch) | |
| tree | 95e476e2d0ce5885684e619ddbcb5996241f4c94 /nis/nss_nis/nis-hosts.c | |
| parent | 91df99f7f25d7b63ba36d54e41bc33ac6901f22d (diff) | |
| download | glibc-315eb1d86aea489cd6325fd1c2521dcfb4fc0e1c.tar.gz glibc-315eb1d86aea489cd6325fd1c2521dcfb4fc0e1c.tar.xz glibc-315eb1d86aea489cd6325fd1c2521dcfb4fc0e1c.zip | |
Fix unbound stack use in NIS NSS module
Diffstat (limited to 'nis/nss_nis/nis-hosts.c')
| -rw-r--r-- | nis/nss_nis/nis-hosts.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/nis/nss_nis/nis-hosts.c b/nis/nss_nis/nis-hosts.c index 462176ea03..d6192b1c77 100644 --- a/nis/nss_nis/nis-hosts.c +++ b/nis/nss_nis/nis-hosts.c @@ -270,6 +270,13 @@ internal_gethostbyname2_r (const char *name, int af, struct hostent *host, /* Convert name to lowercase. */ size_t namlen = strlen (name); + /* Limit name length to the maximum size of an RPC packet. */ + if (namlen > UDPMSGSIZE) + { + *errnop = ERANGE; + return NSS_STATUS_UNAVAIL; + } + char name2[namlen + 1]; size_t i; @@ -461,6 +468,13 @@ _nss_nis_gethostbyname4_r (const char *name, struct gaih_addrtuple **pat, /* Convert name to lowercase. */ size_t namlen = strlen (name); + /* Limit name length to the maximum size of an RPC packet. */ + if (namlen > UDPMSGSIZE) + { + *errnop = ERANGE; + return NSS_STATUS_UNAVAIL; + } + char name2[namlen + 1]; size_t i; |