From bdce95930e1d9a7d013d1ba78740243491262879 Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Mon, 23 May 2016 20:18:34 +0200 Subject: [PATCH] CVE-2016-4429: sunrpc: Do not use alloca in clntudp_call [BZ #20112] The call is technically in a loop, and under certain circumstances (which are quite difficult to reproduce in a test case), alloca can be invoked repeatedly during a single call to clntudp_call. As a result, the available stack space can be exhausted (even though individual alloca sizes are bounded implicitly by what can fit into a UDP packet, as a side effect of the earlier successful send operation). (cherry picked from commit bc779a1a5b3035133024b21e2f339fe4219fb11c) --- ChangeLog | 7 +++++++ NEWS | 4 ++++ sunrpc/clnt_udp.c | 10 +++++++++- 3 files changed, 20 insertions(+), 1 deletion(-) diff --git a/sunrpc/clnt_udp.c b/sunrpc/clnt_udp.c index a6cf5f1..4d9acb1 100644 --- a/sunrpc/clnt_udp.c +++ b/sunrpc/clnt_udp.c @@ -388,9 +388,15 @@ send_again: struct sock_extended_err *e; struct sockaddr_in err_addr; struct iovec iov; - char *cbuf = (char *) alloca (outlen + 256); + char *cbuf = malloc (outlen + 256); int ret; + if (cbuf == NULL) + { + cu->cu_error.re_errno = errno; + return (cu->cu_error.re_status = RPC_CANTRECV); + } + iov.iov_base = cbuf + 256; iov.iov_len = outlen; msg.msg_name = (void *) &err_addr; @@ -415,10 +421,12 @@ send_again: cmsg = CMSG_NXTHDR (&msg, cmsg)) if (cmsg->cmsg_level == SOL_IP && cmsg->cmsg_type == IP_RECVERR) { + free (cbuf); e = (struct sock_extended_err *) CMSG_DATA(cmsg); cu->cu_error.re_errno = e->ee_errno; return (cu->cu_error.re_status = RPC_CANTRECV); } + free (cbuf); } #endif do -- 2.9.3 name='id' value='6e27edda2c9987eeacf4782e6468f99dd1e58e63'/>
path: root/gnu/packages/aux-files/linux-libre/5.4-i686.conf
AgeCommit message (Expand)Author
2020-01-15gnu: linux-libre: Include more framebuffer font sizes....Add the 32x16 Terminus font for ‘high-DPI’ screens, and a 6x10 font that allows for more (debugging) information to be displayed on standard-DPI ones, while still being pleasant to read. * gnu/packages/aux-files/linux-libre/4.14-arm.conf, gnu/packages/aux-files/linux-libre/4.14-i686.conf, gnu/packages/aux-files/linux-libre/4.14-x86_64.conf, gnu/packages/aux-files/linux-libre/4.19-arm.conf, gnu/packages/aux-files/linux-libre/4.19-arm64.conf, gnu/packages/aux-files/linux-libre/4.19-i686.conf, gnu/packages/aux-files/linux-libre/4.19-x86_64.conf, gnu/packages/aux-files/linux-libre/4.4-i686.conf, gnu/packages/aux-files/linux-libre/4.4-x86_64.conf, gnu/packages/aux-files/linux-libre/4.9-i686.conf, gnu/packages/aux-files/linux-libre/4.9-x86_64.conf, gnu/packages/aux-files/linux-libre/5.4-arm-veyron.conf, gnu/packages/aux-files/linux-libre/5.4-arm.conf, gnu/packages/aux-files/linux-libre/5.4-arm64.conf, gnu/packages/aux-files/linux-libre/5.4-i686.conf, gnu/packages/aux-files/linux-libre/5.4-x86_64.conf: Set CONFIG_FONTS=y, CONFIG_FONT_TER16x32=y, and CONFIG_FONT_6x10=y. Tobias Geerinckx-Rice
2019-12-18gnu: linux-libre: Update to 5.4.5....* gnu/packages/aux-files/linux-libre/5.3-arm-veyron.conf, gnu/packages/aux-files/linux-libre/5.3-arm.conf, gnu/packages/aux-files/linux-libre/5.3-arm64.conf, gnu/packages/aux-files/linux-libre/5.3-i686.conf, gnu/packages/aux-files/linux-libre/5.3-x86_64.conf: Delete files. * gnu/packages/aux-files/linux-libre/5.4-arm-veyron.conf, gnu/packages/aux-files/linux-libre/5.4-arm.conf, gnu/packages/aux-files/linux-libre/5.4-arm64.conf, gnu/packages/aux-files/linux-libre/5.4-i686.conf, gnu/packages/aux-files/linux-libre/5.4-x86_64.conf: New files. * Makefile.am (AUX_FILES): Update accordingly. * gnu/packages/patches/linux-libre-active-entropy.patch: Delete file. * gnu/local.mk (dist_patch_DATA): Remove it. * gnu/packages/linux.scm (deblob-scripts-5.3, linux-libre-5.3-version) (linux-libre-5.3-pristine-source, linux-libre-5.3-source) (linux-libre-headers-5.3, linux-libre-5.3): Remove variables. (deblob-scripts-5.4, linux-libre-5.4-version) (linux-libre-5.4-pristine-source, linux-libre-5.4-source) (linux-libre-headers-5.4, linux-libre-5.4): New variables. (linux-libre-version, linux-libre-pristine-source) (linux-libre-source, linux-libre): Point to linux-libre-5.4*. Mark H Weaver