lkml.org 
[lkml]   [2005]   [Jun]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectPotential xdr_xcode_array2 security issue (was: Re: [PATCH] RPC: Encode and decode arbitrary XDR arrays)
Date
* Linux Kernel Mailing List:

> +xdr_xcode_array2(struct xdr_buf *buf, unsigned int base,
> + struct xdr_array2_desc *desc, int encode)
> +{
> + char *elem = NULL, *c;
> + unsigned int copied = 0, todo, avail_here;
> + struct page **ppages = NULL;
> + int err;
> +
> + if (encode) {
> + if (xdr_encode_word(buf, base, desc->array_len) != 0)
> + return -EINVAL;
> + } else {
> + if (xdr_decode_word(buf, base, &desc->array_len) != 0 ||
> + (unsigned long) base + 4 + desc->array_len *
> + desc->elem_size > buf->len)
> + return -EINVAL;
> + }

This looks suspiciously like CVE-2002-0391.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-06-23 07:53    [W:0.057 / U:21.188 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site