* svc_auth_gssapi.c (_svcauth_gssapi): Don't explicitly free

	call_arg on error, since svc_getargs should do that now.

	* svc_udp.c (svcudp_getargs): Free args on xdr decode error to
	avoid leaks.

	* svc_tcp.c (svctcp_getargs): Free args on xdr decode error to
	avoid leaks.

	* svc_raw.c (svcraw_getargs): Free args on xdr decode error to
	avoid leaks.

	* auth_gssapi.c (auth_gssapi_create): Don't explicitly free
	call_res anymore, since clnt_call should deal now.

	* clnt_udp.c (clntudp_call): Free stuff on error from
	xdr_replymsg() to prevent leaking.

	* clnt_tcp.c (clnttcp_call): Free stuff on error from
	xdr_replymsg() to avoid leaking.

	* clnt_raw.c (clntraw_call): Free stuff on error from
	xdr_replymsg() to avoid leaking.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@12052 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/rpc/ChangeLog b/src/lib/rpc/ChangeLog
index 444225c2a0d54ce6d01cdc63e282919a9dd772d8..27150b24f71c493bfa2f4d8fa0758eb099a32f75 100644 (file)
--- a/src/lib/rpc/ChangeLog
+++ b/src/lib/rpc/ChangeLog
@@ -1,3 +1,29 @@
+2000-02-17  Tom Yu  <tlyu@mit.edu>
+
+       * svc_auth_gssapi.c (_svcauth_gssapi): Don't explicitly free
+       call_arg on error, since svc_getargs should do that now.
+
+       * svc_udp.c (svcudp_getargs): Free args on xdr decode error to
+       avoid leaks.
+
+       * svc_tcp.c (svctcp_getargs): Free args on xdr decode error to
+       avoid leaks.
+
+       * svc_raw.c (svcraw_getargs): Free args on xdr decode error to
+       avoid leaks.
+
+       * auth_gssapi.c (auth_gssapi_create): Don't explicitly free
+       call_res anymore, since clnt_call should deal now.
+
+       * clnt_udp.c (clntudp_call): Free stuff on error from
+       xdr_replymsg() to prevent leaking.
+
+       * clnt_tcp.c (clnttcp_call): Free stuff on error from
+       xdr_replymsg() to avoid leaking.
+
+       * clnt_raw.c (clntraw_call): Free stuff on error from
+       xdr_replymsg() to avoid leaking.
+
 2000-02-16  Tom Yu  <tlyu@mit.edu>
 
        * auth_gssapi.c (auth_gssapi_create): Free call_res because

diff --git a/src/lib/rpc/auth_gssapi.c b/src/lib/rpc/auth_gssapi.c
index a81c2faf672aab0332095a1e2df8a185ac40c538..49d8846ee2adf2916ac32d099bc21b674ddd9383 100644 (file)
--- a/src/lib/rpc/auth_gssapi.c
+++ b/src/lib/rpc/auth_gssapi.c
@@ -293,7 +293,6 @@ next_token:
          if (callstat != RPC_SUCCESS) {
               struct rpc_err err;
 
-              xdr_free(xdr_authgssapi_init_res, &call_res);
               clnt_geterr(clnt, &err);
               if (callstat == RPC_AUTHERROR &&
                   (err.re_why == AUTH_BADCRED || err.re_why == AUTH_FAILED)

diff --git a/src/lib/rpc/clnt_raw.c b/src/lib/rpc/clnt_raw.c
index ec5fa6f90d610df05382367688e03bbe91a62e1c..44fbf5da2aa3087a45828a71955f2c68011560ee 100644 (file)
--- a/src/lib/rpc/clnt_raw.c
+++ b/src/lib/rpc/clnt_raw.c
@@ -169,8 +169,23 @@ call_again:
        msg.acpted_rply.ar_verf = _null_auth;
        msg.acpted_rply.ar_results.where = resultsp;
        msg.acpted_rply.ar_results.proc = xresults;
-       if (! xdr_replymsg(xdrs, &msg))
+       if (! xdr_replymsg(xdrs, &msg)) {
+               /*
+                * It's possible for xdr_replymsg() to fail partway
+                * through its attempt to decode the result from the
+                * server. If this happens, it will leave the reply
+                * structure partially populated with dynamically
+                * allocated memory. (This can happen if someone uses
+                * clntudp_bufcreate() to create a CLIENT handle and
+                * specifies a receive buffer size that is too small.)
+                * This memory must be free()ed to avoid a leak.
+                */
+               int op = xdrs->x_op;
+               xdrs->x_op = XDR_FREE;
+               xdr_replymsg(xdrs, &msg);
+               xdrs->x_op = op;
                return (RPC_CANTDECODERES);
+       }
        sunrpc_seterr_reply(&msg, &error);
        status = error.re_status;
 

diff --git a/src/lib/rpc/clnt_tcp.c b/src/lib/rpc/clnt_tcp.c
index 6f36553b981b4d33c5cf4c4305f004ca722e33a8..4e10a489f75eb859f155ab6c93575391bd98af80 100644 (file)
--- a/src/lib/rpc/clnt_tcp.c
+++ b/src/lib/rpc/clnt_tcp.c
@@ -283,6 +283,15 @@ call_again:
                        return (ct->ct_error.re_status);
                /* now decode and validate the response header */
                if (! xdr_replymsg(xdrs, &reply_msg)) {
+                       /*
+                        * Free some stuff allocated by xdr_replymsg()
+                        * to avoid leaks, since it may allocate
+                        * memory from partially successful decodes.
+                        */
+                       int op = xdrs->x_op;
+                       xdrs->x_op = XDR_FREE;
+                       xdr_replymsg(xdrs, &reply_msg);
+                       xdrs->x_op = op;
                        if (ct->ct_error.re_status == RPC_SUCCESS)
                                continue;
                        return (ct->ct_error.re_status);

diff --git a/src/lib/rpc/clnt_udp.c b/src/lib/rpc/clnt_udp.c
index 7ef61c9750d8c6915e7faf7bd8b6c987265fec1d..60469429dd046c1fb8c4cafcab02368e9bf5eb02 100644 (file)
--- a/src/lib/rpc/clnt_udp.c
+++ b/src/lib/rpc/clnt_udp.c
@@ -379,6 +379,21 @@ send_again:
                } 
        }  /* end of valid reply message */
        else {
+               /*
+                * It's possible for xdr_replymsg() to fail partway
+                * through its attempt to decode the result from the
+                * server. If this happens, it will leave the reply
+                * structure partially populated with dynamically
+                * allocated memory. (This can happen if someone uses
+                * clntudp_bufcreate() to create a CLIENT handle and
+                * specifies a receive buffer size that is too small.)
+                * This memory must be free()ed to avoid a leak.
+                */
+               int op = reply_xdrs.x_op;
+               reply_xdrs.x_op = XDR_FREE;
+               xdr_replymsg(&reply_xdrs, &reply_msg);
+               reply_xdrs.x_op = op;
+               return (RPC_CANTDECODERES);
                cu->cu_error.re_status = RPC_CANTDECODERES;
        }
        return (cu->cu_error.re_status);

diff --git a/src/lib/rpc/svc_auth_gssapi.c b/src/lib/rpc/svc_auth_gssapi.c
index b1c275a4e23f25a3f4b0c54452acf2ccf46c2cc8..827596a3b6f0a8137ebf68e9579f0f3b10c91484 100644 (file)
--- a/src/lib/rpc/svc_auth_gssapi.c
+++ b/src/lib/rpc/svc_auth_gssapi.c
@@ -271,7 +271,6 @@ enum auth_stat _svcauth_gssapi(rqst, msg, no_dispatch)
                            &call_arg)) {
               PRINTF(("svcauth_gssapi: cannot decode args\n"));
               LOG_MISCERR("protocol error in procedure arguments");
-              xdr_free(xdr_authgssapi_init_arg, &call_arg);
               ret = AUTH_BADCRED;
               goto error;
          }

diff --git a/src/lib/rpc/svc_raw.c b/src/lib/rpc/svc_raw.c
index e5d96678356416f42731420dece371abaa87c1bf..23ff8898aa0eab52d6e88b6ac0a08599377e1f86 100644 (file)
--- a/src/lib/rpc/svc_raw.c
+++ b/src/lib/rpc/svc_raw.c
@@ -141,7 +141,11 @@ svcraw_getargs(xprt, xdr_args, args_ptr)
 
        if (srp == 0)
                return (FALSE);
-       return ((*xdr_args)(&srp->xdr_stream, args_ptr));
+       if (! (*xdr_args)(&srp->xdr_stream, args_ptr)) {
+               (void)svcraw_freeargs(xprt, xdr_args, args_ptr);
+               return FALSE;
+       }
+       return TRUE;
 }
 
 static bool_t

diff --git a/src/lib/rpc/svc_tcp.c b/src/lib/rpc/svc_tcp.c
index 60872c54bbc1451e50f71ccb66720d2519482d30..cece276cdf86f709a0c1a6bfd60ca58d8429e179 100644 (file)
--- a/src/lib/rpc/svc_tcp.c
+++ b/src/lib/rpc/svc_tcp.c
@@ -398,9 +398,13 @@ svctcp_getargs(xprt, xdr_args, args_ptr)
        xdrproc_t xdr_args;
        caddr_t args_ptr;
 {
-     return (SVCAUTH_UNWRAP(xprt->xp_auth,
-                           &(((struct tcp_conn *)(xprt->xp_p1))->xdrs),
-                           xdr_args, args_ptr));
+       if (! SVCAUTH_UNWRAP(xprt->xp_auth,
+                            &(((struct tcp_conn *)(xprt->xp_p1))->xdrs),
+                            xdr_args, args_ptr)) {
+               (void)svctcp_freeargs(xprt, xdr_args, args_ptr);
+               return FALSE;
+       }
+       return TRUE;
 }
 
 static bool_t

diff --git a/src/lib/rpc/svc_udp.c b/src/lib/rpc/svc_udp.c
index 454f99fc56d9328616aae6521f020e9cd83dfb07..c17b4acbbfed79aae3c2fa0dfd7b98fdde7c2c48 100644 (file)
--- a/src/lib/rpc/svc_udp.c
+++ b/src/lib/rpc/svc_udp.c
@@ -272,8 +272,12 @@ svcudp_getargs(xprt, xdr_args, args_ptr)
        xdrproc_t xdr_args;
        caddr_t args_ptr;
 {
-     return (SVCAUTH_UNWRAP(xprt->xp_auth, &(su_data(xprt)->su_xdrs),
-                        xdr_args, args_ptr));
+       if (! SVCAUTH_UNWRAP(xprt->xp_auth, &(su_data(xprt)->su_xdrs),
+                            xdr_args, args_ptr)) {
+               (void)svcudp_freeargs(xprt, xdr_args, args_ptr);
+               return FALSE;
+       }
+       return TRUE;
 }
 
 static bool_t