[PATCH] rpcinfo: stack buffer overflow in rpcinfo rpcbdump()

[PATCH] rpcinfo: stack buffer overflow in rpcinfo rpcbdump()

[Krzesimir Nowak]

rpcinfo's rpcbdump() formats a server-controlled list of versions into
a fixed size buffer with sprintf(). A malicious server returning a
large number of versions may overflow it.

Reported-by: Michalis Vasileiadis <vmihalis.tmd@gmail.com>
Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 src/rpcinfo.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/src/rpcinfo.c b/src/rpcinfo.c
index 30d535e..9917913 100644
--- a/src/rpcinfo.c
+++ b/src/rpcinfo.c
@@ -958,17 +958,19 @@ rpcbdump (
       for (rs = rs_head; rs; rs = rs->next)
 	{
 	  size_t netidmax = sizeof(buf) - 1;
-	  char *p = buf;
+	  int l = 0;
 
 	  printf ("%10ld  ", rs->prog);
 	  for (vl = rs->vlist; vl; vl = vl->next)
 	    {
-	      sprintf (p, "%d", vl->vers);
-	      p = p + strlen (p);
+	      l += printf ("%d", vl->vers);
 	      if (vl->next)
-		sprintf (p++, ",");
+		l += printf (",");
 	    }
-	  printf ("%-10s", buf);
+	  if (l < 10)
+	    printf("%*s", 10 - l, " ");
+	  else
+	    printf(" ");
 	  buf[0] = '\0';
 
           for (nl = rs->nlist; nl; nl = nl->next)
-- 
2.54.0

Re: [PATCH] rpcinfo: stack buffer overflow in rpcinfo rpcbdump()

[Steve Dickson]

On 8/28/26 11:38 AM, Krzesimir Nowak wrote:
> rpcinfo's rpcbdump() formats a server-controlled list of versions into
> a fixed size buffer with sprintf(). A malicious server returning a
> large number of versions may overflow it.
> 
> Reported-by: Michalis Vasileiadis <vmihalis.tmd@gmail.com>
> Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
Committed... (tag: rpcbind-1_2_9-rc2)

steved.

> ---
>   src/rpcinfo.c | 12 +++++++-----
>   1 file changed, 7 insertions(+), 5 deletions(-)
> 
> diff --git a/src/rpcinfo.c b/src/rpcinfo.c
> index 30d535e..9917913 100644
> --- a/src/rpcinfo.c
> +++ b/src/rpcinfo.c
> @@ -958,17 +958,19 @@ rpcbdump (
>         for (rs = rs_head; rs; rs = rs->next)
>   	{
>   	  size_t netidmax = sizeof(buf) - 1;
> -	  char *p = buf;
> +	  int l = 0;
>   
>   	  printf ("%10ld  ", rs->prog);
>   	  for (vl = rs->vlist; vl; vl = vl->next)
>   	    {
> -	      sprintf (p, "%d", vl->vers);
> -	      p = p + strlen (p);
> +	      l += printf ("%d", vl->vers);
>   	      if (vl->next)
> -		sprintf (p++, ",");
> +		l += printf (",");
>   	    }
> -	  printf ("%-10s", buf);
> +	  if (l < 10)
> +	    printf("%*s", 10 - l, " ");
> +	  else
> +	    printf(" ");
>   	  buf[0] = '\0';
>   
>             for (nl = rs->nlist; nl; nl = nl->next)