From hans@stare.cz  Thu Feb  9 14:03:27 2006
Return-Path: <hans@stare.cz>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id EFF3816A420
	for <FreeBSD-gnats-submit@freebsd.org>; Thu,  9 Feb 2006 14:03:27 +0000 (GMT)
	(envelope-from hans@stare.cz)
Received: from ns.stare.cz (ns.stare.cz [81.95.102.106])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 7F7DB43D64
	for <FreeBSD-gnats-submit@freebsd.org>; Thu,  9 Feb 2006 14:03:27 +0000 (GMT)
	(envelope-from hans@stare.cz)
Received: by ns.stare.cz (Postfix, from userid 1001)
	id 3E444B865; Thu,  9 Feb 2006 15:03:25 +0100 (CET)
Message-Id: <20060209140325.3E444B865@ns.stare.cz>
Date: Thu,  9 Feb 2006 15:03:25 +0100 (CET)
From: Jan Stary <hans@stare.cz>
Reply-To: Jan Stary <hans@stare.cz>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: xdr_string might call strlen(3) on NULL
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         93093
>Category:       kern
>Synopsis:       [libc] xdr_string might call strlen(3) on NULL
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Feb 09 14:10:01 GMT 2006
>Closed-Date:    
>Last-Modified:  Fri Feb 10 02:01:59 GMT 2006
>Originator:     Jan Stary
>Release:        FreeBSD 6.0-RELEASE-p1 i386
>Organization:
>Environment:
System: FreeBSD dell.stare.cz 6.0-RELEASE-p1 FreeBSD 6.0-RELEASE-p1 #3: Sat Jan
14 13:55:07 CET 2006  root@dell.stare.cz:/usr/obj/usr/src/sys/DELLLS  i386

>Description:
	
	The xdr_string(3) routine as present in usr/src/lib/libc/xdr/xdr.c
	calls strlen() on the passed string during XDR_ENCODE, without
	checking if it is NULL:

	xdr_string(xdrs, cpp, maxsize) {
	char *sp = *cpp;  /* sp is the actual string pointer */
	switch (xdrs->x_op) {
	case XDR_ENCODE:
		size = strlen(sp);
		break;
	

>How-To-Repeat:

#include <string.h>
#include <stdlib.h>
#include <stdio.h>

#include <rpc/types.h>
#include <rpc/xdr.h>


int main() {

	XDR xdrs;
	char *string = NULL;

	xdrs.x_ops = NULL;
	xdrstdio_create(&xdrs, stdout, XDR_ENCODE);

	if(NULL==xdrs.x_ops) {
		fprintf(stderr, "x_ops still NULL after initialization!\n");
		return 1;
	}
	
	string = NULL; /* this will make xdr_string dump a core */
	/* string = strdup("this will get correctly encoded"); */
	if(! xdr_string(&xdrs, &string, 64)) {
		fprintf(stderr, "cannot XDR_ENCODE string!\n");
		return 1;
	}

	xdr_destroy(&xdrs);
	free(string);

	return 0;
}


>Fix:

	The routine should probably check if (sp == NULL), and in that
	case just return(FALSE);

>Release-Note:
>Audit-Trail:
>Unformatted:
