From 315eb1d86aea489cd6325fd1c2521dcfb4fc0e1c Mon Sep 17 00:00:00 2001 From: Andreas Schwab Date: Thu, 8 May 2014 16:53:01 +0200 Subject: Fix unbound stack use in NIS NSS module --- nis/nss_nis/nis-hosts.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'nis/nss_nis/nis-hosts.c') diff --git a/nis/nss_nis/nis-hosts.c b/nis/nss_nis/nis-hosts.c index 462176ea03..d6192b1c77 100644 --- a/nis/nss_nis/nis-hosts.c +++ b/nis/nss_nis/nis-hosts.c @@ -270,6 +270,13 @@ internal_gethostbyname2_r (const char *name, int af, struct hostent *host, /* Convert name to lowercase. */ size_t namlen = strlen (name); + /* Limit name length to the maximum size of an RPC packet. */ + if (namlen > UDPMSGSIZE) + { + *errnop = ERANGE; + return NSS_STATUS_UNAVAIL; + } + char name2[namlen + 1]; size_t i; @@ -461,6 +468,13 @@ _nss_nis_gethostbyname4_r (const char *name, struct gaih_addrtuple **pat, /* Convert name to lowercase. */ size_t namlen = strlen (name); + /* Limit name length to the maximum size of an RPC packet. */ + if (namlen > UDPMSGSIZE) + { + *errnop = ERANGE; + return NSS_STATUS_UNAVAIL; + } + char name2[namlen + 1]; size_t i; -- cgit 1.4.1