diff options
| author | J. Bruce Fields <[email protected]> | 2013-10-08 15:33:53 -0400 |
|---|---|---|
| committer | J. Bruce Fields <[email protected]> | 2013-10-08 15:56:15 -0400 |
| commit | c66080ad0a9295eaf0246a46949619f92c75faaa (patch) | |
| tree | 38fd10d01b9c74b988d86dccffa2ddbfc46fb22d | |
| parent | 97e47fa11deae10ae72aa1109e700565c57152f5 (diff) | |
svcrpc: fix gss-proxy NULL dereference in some error cases
We depend on the xdr decoder to set this pointer, but if we error out
before we decode this piece it could be left NULL.
I think this is probably tough to hit without a buggy gss-proxy.
Reported-by: Andi Kleen <[email protected]>
Cc: Simo Sorce <[email protected]>
Signed-off-by: J. Bruce Fields <[email protected]>
| -rw-r--r-- | net/sunrpc/auth_gss/gss_rpc_upcall.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/sunrpc/auth_gss/gss_rpc_upcall.c b/net/sunrpc/auth_gss/gss_rpc_upcall.c index f1eb0d16666c..458f85e9b0ba 100644 --- a/net/sunrpc/auth_gss/gss_rpc_upcall.c +++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c @@ -298,7 +298,8 @@ int gssp_accept_sec_context_upcall(struct net *net, if (res.context_handle) { data->out_handle = rctxh.exported_context_token; data->mech_oid.len = rctxh.mech.len; - memcpy(data->mech_oid.data, rctxh.mech.data, + if (rctxh.mech.data) + memcpy(data->mech_oid.data, rctxh.mech.data, data->mech_oid.len); client_name = rctxh.src_name.display_name; } |