diff options
| author | Leo Famulari <leo@famulari.name> | 2017-05-04 21:26:03 -0400 |
|---|---|---|
| committer | Leo Famulari <leo@famulari.name> | 2017-05-05 15:33:00 -0400 |
| commit | c39a54f431cc6ae61a09f8b06f3593939dd14c9b (patch) | |
| tree | fd9c187b1b81db3e35f360a7d21a3b86b9f59737 /gnu/packages/patches/rpcbind-CVE-2017-8779.patch | |
| parent | 2beb879b4befa553677c8f6562305664186c7614 (diff) | |
| download | gnu-guix-c39a54f431cc6ae61a09f8b06f3593939dd14c9b.tar gnu-guix-c39a54f431cc6ae61a09f8b06f3593939dd14c9b.tar.gz | |
gnu: rpcbind, libtirpc: Fix CVE-2017-8779.
* gnu/packages/patches/libtirpc-CVE-2017-8779.patch,
gnu/packages/patches/rpcbind-CVE-2017-8779.patch: New files.
* gnu/local.mk (dist_patch_DATA): Add them.
* gnu/packages/onc-rpc.scm (rpcbind, libtirpc)[source]: Use them.
Diffstat (limited to 'gnu/packages/patches/rpcbind-CVE-2017-8779.patch')
| -rw-r--r-- | gnu/packages/patches/rpcbind-CVE-2017-8779.patch | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/gnu/packages/patches/rpcbind-CVE-2017-8779.patch b/gnu/packages/patches/rpcbind-CVE-2017-8779.patch new file mode 100644 index 0000000000..6ca93ff12b --- /dev/null +++ b/gnu/packages/patches/rpcbind-CVE-2017-8779.patch @@ -0,0 +1,29 @@ +Fix CVE-2017-8779: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8779 + +Patch copied from the bug reporter's 3rd-party repository: + +https://github.com/guidovranken/rpcbomb/blob/master/rpcbind_patch.txt + +diff --git a/src/rpcb_svc_com.c b/src/rpcb_svc_com.c +index 5862c26..e11f61b 100644 +--- a/src/rpcb_svc_com.c ++++ b/src/rpcb_svc_com.c +@@ -48,6 +48,7 @@ + #include <rpc/rpc.h> + #include <rpc/rpcb_prot.h> + #include <rpc/svc_dg.h> ++#include <rpc/rpc_com.h> + #include <netconfig.h> + #include <errno.h> + #include <syslog.h> +@@ -432,7 +433,7 @@ rpcbproc_taddr2uaddr_com(void *arg, struct svc_req *rqstp /*__unused*/, + static bool_t + xdr_encap_parms(XDR *xdrs, struct encap_parms *epp) + { +- return (xdr_bytes(xdrs, &(epp->args), (u_int *) &(epp->arglen), ~0)); ++ return (xdr_bytes(xdrs, &(epp->args), (u_int *) &(epp->arglen), RPC_MAXDATASIZE)); + } + + /* |