From: Mark Vitale <mvitale@sinenomine.net>
Date: Tue, 26 Jun 2018 07:37:37 +0000 (-0400)
Subject: OPENAFS-SA-2018-002 ptserver: prevent PR_ListEntries information leak
X-Git-Tag: openafs-devel-1_9_0~475
X-Git-Url: https://git.openafs.org/?p=openafs.git;a=commitdiff_plain;h=9d1aeb5d761581a35bef2042e9116b96e9ae3bf5

OPENAFS-SA-2018-002 ptserver: prevent PR_ListEntries information leak

PR_ListEntries (pts listentries) does not properly initialize its output
buffers.  This leaks ptserver memory over the wire:

struct prlistentries
- up to 62 bytes for each entry name (PR_MAXNAMELEN 64 - 'a\0')

Initialize the buffer, and remove the now redundant memset for the
reserved fields.

Change-Id: I29d70c7e4dd567b8b046037f29f71911b8a0593f
---

diff --git a/src/ptserver/ptprocs.c b/src/ptserver/ptprocs.c
index 5e66fdf..4ce1cbf 100644
--- a/src/ptserver/ptprocs.c
+++ b/src/ptserver/ptprocs.c
@@ -1538,6 +1538,7 @@ put_prentries(struct prentry *tentry, prentries *bulkentries)
     entry = bulkentries->prentries_val;
     entry += bulkentries->prentries_len;
 
+    memset(entry, 0, sizeof(*entry));
     entry->flags = tentry->flags >> PRIVATE_SHIFT;
     if (entry->flags == 0) {
 	entry->flags =
@@ -1552,7 +1553,6 @@ put_prentries(struct prentry *tentry, prentries *bulkentries)
     entry->nusers = tentry->nusers;
     entry->count = tentry->count;
     strncpy(entry->name, tentry->name, PR_MAXNAMELEN);
-    memset(entry->reserved, 0, sizeof(entry->reserved));
     bulkentries->prentries_len++;
     return 0;
 }