diff options
| author | Andreas Schwab <schwab@suse.de> | 2014-05-08 16:53:01 +0200 |
|---|---|---|
| committer | Andreas Schwab <schwab@suse.de> | 2014-05-12 15:17:51 +0200 |
| commit | 315eb1d86aea489cd6325fd1c2521dcfb4fc0e1c (patch) | |
| tree | 95e476e2d0ce5885684e619ddbcb5996241f4c94 /nis/nss_nis/nis-network.c | |
| parent | 91df99f7f25d7b63ba36d54e41bc33ac6901f22d (diff) | |
| download | glibc-315eb1d86aea489cd6325fd1c2521dcfb4fc0e1c.tar.gz glibc-315eb1d86aea489cd6325fd1c2521dcfb4fc0e1c.tar.xz glibc-315eb1d86aea489cd6325fd1c2521dcfb4fc0e1c.zip | |
Fix unbound stack use in NIS NSS module
Diffstat (limited to 'nis/nss_nis/nis-network.c')
| -rw-r--r-- | nis/nss_nis/nis-network.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/nis/nss_nis/nis-network.c b/nis/nss_nis/nis-network.c index f28fbdaa4f..f1b72bcd75 100644 --- a/nis/nss_nis/nis-network.c +++ b/nis/nss_nis/nis-network.c @@ -179,6 +179,13 @@ _nss_nis_getnetbyname_r (const char *name, struct netent *net, char *buffer, /* Convert name to lowercase. */ size_t namlen = strlen (name); + /* Limit name length to the maximum size of an RPC packet. */ + if (namlen > UDPMSGSIZE) + { + *errnop = ERANGE; + return NSS_STATUS_UNAVAIL; + } + char name2[namlen + 1]; size_t i; |