← Back to branch summary

~ubuntu-branches/debian/sid/nfs-utils/sid

« back to all changes in this revision

Viewing changes to debian/patches/22-mountd-fix-segfault-in-add_name-with-newer-gcc-compi.patch

  • Committer: Package Import Robot
  • Author(s): Steve Langasek
  • Date: 2014-08-12 17:12:38 UTC
  • Revision ID: package-import@ubuntu.com-20140812171238-foqromrq96ai1sge
Tags: 1:1.2.8-9
http://bugs.debian.org/757835
https://launchpad.net/bugs/1355829
debian/patches/22-mountd-fix-segfault-in-add_name-with-newer-gcc-
compi.patch: cherry-pick fix from upstream for a segfault in 
add_name with newer gcc compilers.  Closes: #757835, LP: #1355829.

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/22-mountd-fix-segfault-in-add_name-with-newer-gcc-compi.patch
 
1
From 8b03fdbfb0dd8e0147aa61ff30b8311235caf5f3 Mon Sep 17 00:00:00 2001
 
2
From: Jeff Layton <jlayton@poochiereds.net>
 
3
Date: Thu, 1 May 2014 11:15:16 -0400
 
4
Subject: [PATCH] mountd: fix segfault in add_name with newer gcc compilers
 
5
Bug-Debian: http://bugs.debian.org/757835
 
6
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+bug/1355829
 
7
 
 
8
I hit a segfault in add_name with a mountd built with gcc-4.9.0. Some
 
9
NULL pointer checks got reordered such that a pointer was dereferenced
 
10
before checking to see whether it was NULL. The problem was due to
 
11
nfs-utils relying on undefined behavior, which tricked gcc into assuming
 
12
that the pointer would never be NULL.
 
13
 
 
14
At first I assumed that this was a compiler bug, but Jakub Jelinek and
 
15
Jeff Law pointed out:
 
16
 
 
17
"If old is NULL, then:
 
18
 
 
19
        strncpy(new, old, cp-old);
 
20
 
 
21
is undefined behavior (even when cp == old == NULL in that case),
 
22
therefore gcc assumes that old is never NULL, as otherwise it would be
 
23
invalid.
 
24
 
 
25
Just guard
 
26
        strncpy(new, old, cp-old);
 
27
        new[cp-old] = 0;
 
28
with if (old) { ... }."
 
29
 
 
30
This patch does that. If old is NULL though, then we still need to
 
31
ensure that new is NULL terminated, lest the subsequent strcats walk off
 
32
the end of it.
 
33
 
 
34
Cc: Jeff Law <law@redhat.com>
 
35
Cc: Jakub Jelinek <jakub@redhat.com>
 
36
Signed-off-by: Jeff Layton <jlayton@poochiereds.net>
 
37
Signed-off-by: Steve Dickson <steved@redhat.com>
 
38
---
 
39
 support/export/client.c | 8 ++++++--
 
40
 1 file changed, 6 insertions(+), 2 deletions(-)
 
41
 
 
42
diff --git a/support/export/client.c b/support/export/client.c
 
43
index ba2db8f..e749cac 100644
 
44
--- a/support/export/client.c
 
45
+++ b/support/export/client.c
 
46
@@ -482,8 +482,12 @@ add_name(char *old, const char *add)
 
47
                else
 
48
                        cp = cp + strlen(cp);
 
49
        }
 
50
-       strncpy(new, old, cp-old);
 
51
-       new[cp-old] = 0;
 
52
+       if (old) {
 
53
+               strncpy(new, old, cp-old);
 
54
+               new[cp-old] = 0;
 
55
+       } else {
 
56
+               new[0] = 0;
 
57
+       }
 
58
        if (cp != old && !*cp)
 
59
                strcat(new, ",");
 
60
        strcat(new, add);
 
61
-- 
 
62
2.1.0.rc1
 
63