]> granicus.if.org Git - libtirpc/commit
Fix xp_raddr handling in svc_fd_create etc
authorOlaf Kirch <okir@suse.de>
Tue, 30 Sep 2008 19:04:17 +0000 (15:04 -0400)
committerSteve Dickson <steved@redhat.com>
Tue, 30 Sep 2008 19:04:17 +0000 (15:04 -0400)
commit59c374c4b507aeca957ed0096d98006edf601375
tree49248596b39fb1829c48bf05063baf56e4b4c0e9
parent628788c1cc84c86ee4cb36ee5d4fe8954e90fca5
Fix xp_raddr handling in svc_fd_create etc

Currently svc_fd_create tries to do some clever tricks
with IPv4/v6 address mapping.

This is broken for several reasons.
 1. We don't want IPv4 based transport to look like IPv6
  transports. Old applications compiled against tirpc
will expect AF_INET addresses, and are not equipped
to deal with AF_INET6.
 2. There's a buffer overflow.
memcpy(&sin6, &ss, sizeof(ss));
copies a full struct sockaddr to a sockaddr_in6 on
the stack. Unlikely to be exploitable, but I wonder
if this ever worked....

Signed-off-by: Olaf Kirch <okir@suse.de>
Signed-off-by: Steve Dickson <steved@redhat.com>
src/rpc_com.h
src/svc_dg.c
src/svc_vc.c