diff options
| author | Florian Weimer <fweimer@redhat.com> | 2017-04-13 13:09:38 +0200 |
|---|---|---|
| committer | Tulio Magno Quites Machado Filho <tuliom@linux.ibm.com> | 2018-04-06 16:22:49 -0300 |
| commit | 9d0aec236891576c7f12e935128364669b785233 (patch) | |
| tree | ac84a186f708f1077f86f068fff07eb9d26fdcf5 /ChangeLog | |
| parent | 89dc0372bb497b7d51bcf9999ce3f9684d450959 (diff) | |
| download | glibc-9d0aec236891576c7f12e935128364669b785233.tar glibc-9d0aec236891576c7f12e935128364669b785233.tar.gz glibc-9d0aec236891576c7f12e935128364669b785233.tar.bz2 glibc-9d0aec236891576c7f12e935128364669b785233.zip | |
sunrpc: Avoid use-after-free read access in clntudp_call [BZ #21115]
After commit bc779a1a5b3035133024b21e2f339fe4219fb11c
(CVE-2016-4429: sunrpc: Do not use alloca in clntudp_call
[BZ #20112]), ancillary data is stored on the heap,
but it is accessed after it has been freed.
The test case must be run under a heap debugger such as valgrind
to observe the invalid access. A malloc implementation which
immediately calls munmap on free would catch this bug as well.
(cherry picked from commit d42eed4a044e5e10dfb885cf9891c2518a72a491)
Diffstat (limited to 'ChangeLog')
| -rw-r--r-- | ChangeLog | 8 |
1 files changed, 8 insertions, 0 deletions
@@ -1,3 +1,11 @@ +2017-02-27 Florian Weimer <fweimer@redhat.com> + + [BZ #21115] + * sunrpc/clnt_udp.c (clntudp_call): Free ancillary data later. + * sunrpc/Makefile (tests): Add tst-udp-error. + (tst-udp-error): Link against libc.so explicitly. + * sunrpc/tst-udp-error: New file. + 2017-08-16 Andreas Schwab <schwab@suse.de> * elf/ldd.bash.in: Never run file directly. |