summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorJ. Bruce Fields <bfields@redhat.com>2013-10-08 15:33:53 -0400
committerJ. Bruce Fields <bfields@redhat.com>2013-10-08 15:56:15 -0400
commitc66080ad0a9295eaf0246a46949619f92c75faaa (patch)
tree38fd10d01b9c74b988d86dccffa2ddbfc46fb22d /net
parent97e47fa11deae10ae72aa1109e700565c57152f5 (diff)
downloadlinux-c66080ad0a9295eaf0246a46949619f92c75faaa.tar.gz
linux-c66080ad0a9295eaf0246a46949619f92c75faaa.tar.bz2
linux-c66080ad0a9295eaf0246a46949619f92c75faaa.zip
svcrpc: fix gss-proxy NULL dereference in some error cases
We depend on the xdr decoder to set this pointer, but if we error out before we decode this piece it could be left NULL. I think this is probably tough to hit without a buggy gss-proxy. Reported-by: Andi Kleen <andi@firstfloor.org> Cc: Simo Sorce <simo@redhat.com> Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Diffstat (limited to 'net')
-rw-r--r--net/sunrpc/auth_gss/gss_rpc_upcall.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/net/sunrpc/auth_gss/gss_rpc_upcall.c b/net/sunrpc/auth_gss/gss_rpc_upcall.c
index f1eb0d16666c..458f85e9b0ba 100644
--- a/net/sunrpc/auth_gss/gss_rpc_upcall.c
+++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c
@@ -298,7 +298,8 @@ int gssp_accept_sec_context_upcall(struct net *net,
if (res.context_handle) {
data->out_handle = rctxh.exported_context_token;
data->mech_oid.len = rctxh.mech.len;
- memcpy(data->mech_oid.data, rctxh.mech.data,
+ if (rctxh.mech.data)
+ memcpy(data->mech_oid.data, rctxh.mech.data,
data->mech_oid.len);
client_name = rctxh.src_name.display_name;
}