[CVE-2010-0624] checking the returned amount of data and bail out when it is more...

The rmt client in GNU cpio could have a heap overflow when a malicious
remote tape service returns deliberately crafted packets containing
more data than requested.

PR:		gnu/145010
Submitted by:	naddy
Reviewed by:	imp
MFC after:	immediately
Security:	CVE-2010-0624

Change-Id: I489741e2faefd9353307a571a6a32c1e249f4488
Signed-off-by: JinWang An <jinwang.an@samsung.com>

diff --git a/lib/rtapelib.c b/lib/rtapelib.c
index af19b04..c39398e 100644 (file)
--- a/lib/rtapelib.c
+++ b/lib/rtapelib.c
@@ -570,7 +570,8 @@ rmt_read__ (int handle, char *buffer, size_t length)
 
   sprintf (command_buffer, "R%lu\n", (unsigned long) length);
   if (do_command (handle, command_buffer) == -1
-      || (status = get_status (handle)) == SAFE_READ_ERROR)
+      || (status = get_status (handle)) == SAFE_READ_ERROR
+         || status > length)
     return SAFE_READ_ERROR;
 
   for (counter = 0; counter < status; counter += rlen, buffer += rlen)