52 lines
1.5 KiB
Diff
52 lines
1.5 KiB
Diff
commit 4a2d85c64110ee9e21a8c4f9dafd6b0ae621506d
|
|
Author: Zhi Li <yieli@redhat.com>
|
|
Date: Fri Oct 28 14:19:04 2022 -0400
|
|
|
|
clnt_raw.c: fix a possible null pointer dereference
|
|
|
|
Since clntraw_private could be dereferenced before
|
|
allocated, protect it by checking its value in advance.
|
|
|
|
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2138317
|
|
Signed-off-by: Zhi Li <yieli@redhat.com>
|
|
Signed-off-by: Steve Dickson <steved@redhat.com>
|
|
|
|
diff --git a/src/clnt_raw.c b/src/clnt_raw.c
|
|
index 31f9d0c..03f839d 100644
|
|
--- a/src/clnt_raw.c
|
|
+++ b/src/clnt_raw.c
|
|
@@ -142,7 +142,7 @@ clnt_raw_call(h, proc, xargs, argsp, xresults, resultsp, timeout)
|
|
struct timeval timeout;
|
|
{
|
|
struct clntraw_private *clp = clntraw_private;
|
|
- XDR *xdrs = &clp->xdr_stream;
|
|
+ XDR *xdrs;
|
|
struct rpc_msg msg;
|
|
enum clnt_stat status;
|
|
struct rpc_err error;
|
|
@@ -154,6 +154,7 @@ clnt_raw_call(h, proc, xargs, argsp, xresults, resultsp, timeout)
|
|
mutex_unlock(&clntraw_lock);
|
|
return (RPC_FAILED);
|
|
}
|
|
+ xdrs = &clp->xdr_stream;
|
|
mutex_unlock(&clntraw_lock);
|
|
|
|
call_again:
|
|
@@ -245,7 +246,7 @@ clnt_raw_freeres(cl, xdr_res, res_ptr)
|
|
void *res_ptr;
|
|
{
|
|
struct clntraw_private *clp = clntraw_private;
|
|
- XDR *xdrs = &clp->xdr_stream;
|
|
+ XDR *xdrs;
|
|
bool_t rval;
|
|
|
|
mutex_lock(&clntraw_lock);
|
|
@@ -254,6 +255,7 @@ clnt_raw_freeres(cl, xdr_res, res_ptr)
|
|
mutex_unlock(&clntraw_lock);
|
|
return (rval);
|
|
}
|
|
+ xdrs = &clp->xdr_stream;
|
|
mutex_unlock(&clntraw_lock);
|
|
xdrs->x_op = XDR_FREE;
|
|
return ((*xdr_res)(xdrs, res_ptr));
|