[PATCH 1/3] libtirpc: Fix use-after-free in xdr_pmaplist() XDR_FREE path

[Olga Kornievskaia <okorniev@redhat.com>]

The XDR_FREE loop saved a pointer to the pml_next field inside the
struct being freed (next = &((*rp)->pml_next)), then dereferenced it
on the next iteration. This reads freed memory.

Adopt the same pattern xdr_rpcblist_ptr() already uses: save the
value of the next pointer before freeing, then point rp at a stack
copy.

Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
---
 src/pmap_prot2.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/pmap_prot2.c b/src/pmap_prot2.c
index bbac74f..7611bd5 100644
--- a/src/pmap_prot2.c
+++ b/src/pmap_prot2.c
@@ -88,7 +88,8 @@ xdr_pmaplist(XDR *xdrs, struct pmaplist **rp)
 	 */
 	bool_t more_elements;
 	int freeing;
-	struct pmaplist **next	= NULL; /* pacify gcc */
+	struct pmaplist *next = NULL;
+	struct pmaplist *next_copy;
 
 	assert(xdrs != NULL);
 	assert(rp != NULL);
@@ -107,11 +108,16 @@ xdr_pmaplist(XDR *xdrs, struct pmaplist **rp)
 		 * before we free the current object ...
 		 */
 		if (freeing)
-			next = &((*rp)->pml_next); 
+			next = (*rp)->pml_next;
 		if (! xdr_reference(xdrs, (caddr_t *)rp,
 		    (u_int)sizeof(struct pmaplist), (xdrproc_t)xdr_pmap))
 			return (FALSE);
-		rp = (freeing) ? next : &((*rp)->pml_next);
+		if (freeing) {
+			next_copy = next;
+			rp = &next_copy;
+		} else {
+			rp = &((*rp)->pml_next);
+		}
 	}
 }
 
-- 
2.52.0