Commit dc43376c authored by J. Bruce Fields's avatar J. Bruce Fields

svcrpc: fix gss-proxy xdr decoding oops

Uninitialized stack data was being used as the destination for memcpy's.

Longer term we'll just delete some of this code; all we're doing is
skipping over xdr that we don't care about.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
parent 9f96392b
...@@ -430,7 +430,7 @@ static int dummy_enc_nameattr_array(struct xdr_stream *xdr, ...@@ -430,7 +430,7 @@ static int dummy_enc_nameattr_array(struct xdr_stream *xdr,
static int dummy_dec_nameattr_array(struct xdr_stream *xdr, static int dummy_dec_nameattr_array(struct xdr_stream *xdr,
struct gssx_name_attr_array *naa) struct gssx_name_attr_array *naa)
{ {
struct gssx_name_attr dummy; struct gssx_name_attr dummy = { .attr = {.len = 0} };
u32 count, i; u32 count, i;
__be32 *p; __be32 *p;
...@@ -493,12 +493,13 @@ static int gssx_enc_name(struct xdr_stream *xdr, ...@@ -493,12 +493,13 @@ static int gssx_enc_name(struct xdr_stream *xdr,
return err; return err;
} }
static int gssx_dec_name(struct xdr_stream *xdr, static int gssx_dec_name(struct xdr_stream *xdr,
struct gssx_name *name) struct gssx_name *name)
{ {
struct xdr_netobj dummy_netobj; struct xdr_netobj dummy_netobj = { .len = 0 };
struct gssx_name_attr_array dummy_name_attr_array; struct gssx_name_attr_array dummy_name_attr_array = { .count = 0 };
struct gssx_option_array dummy_option_array; struct gssx_option_array dummy_option_array = { .count = 0 };
int err; int err;
/* name->display_name */ /* name->display_name */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment