Public bug reported: rpcgen (Ubuntu EGLIBC 2.15-0ubuntu10.4) 2.15 segfaults or fails with "expected type specifier" if a function argument is longer than 10 characters.
The function get_prog_declaration in libc/sunrpc/rpc_parse.c allocates a 10 character buffer on the stack and then uses unsafe functions to copy to it and write to it. The following patch fixes the problem: diff -uprN eglibc-2.15.old/sunrpc/rpc_parse.c eglibc-2.15.new/sunrpc/rpc_parse.c --- eglibc-2.15.old/sunrpc/rpc_parse.c 2010-08-19 16:32:31.000000000 -0400 +++ eglibc-2.15.new/sunrpc/rpc_parse.c 2013-07-25 18:20:35.291300550 -0400 @@ -521,7 +521,8 @@ static void get_prog_declaration (declaration * dec, defkind dkind, int num /* arg number */ ) { token tok; - char name[10]; /* argument name */ + char name[64]; /* argument name */ + const size_t namelen = sizeof(name); if (dkind == DEF_PROGRAM) { @@ -538,9 +539,12 @@ get_prog_declaration (declaration * dec, get_type (&dec->prefix, &dec->type, dkind); dec->rel = REL_ALIAS; if (peekscan (TOK_IDENT, &tok)) /* optional name of argument */ - strcpy (name, tok.str); + { + strncpy (name, tok.str, namelen); + name[namelen - 1] = '\0'; /* strncpy may not null terminate string */ + } else - sprintf (name, "%s%d", ARGNAME, num); /* default name of argument */ + snprintf (name, namelen, "%s%d", ARGNAME, num); /* default name of argument */ dec->name = (char *) strdup (name); ** Affects: eglibc (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1205126 Title: rpcgen segfaults if argument is longer than 10 characters To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/eglibc/+bug/1205126/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs