Received-SPF: pass (google.com: best guess record for domain of linux-nfs-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Scott Mayhew <smayhew@redhat.com>
To:     steved@redhat.com
Cc:     linux-nfs@vger.kernel.org
Subject: [nfs-utils PATCH] nfsdcld: fix possible buffer overrun in sqlite_iterate_recovery()
Date:   Mon, 13 Apr 2020 10:44:35 -0400
Message-Id: <20200413144435.1220985-1-smayhew@redhat.com>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Sender: linux-nfs-owner@vger.kernel.org
Precedence: bulk

Prior to release, cp_data was originally intended to hold the gss
principal string.  When it was changed to hold a hash of the principal
instead, the size of the field was changed but the 'n' arg of the
memcpy() in sqlite_iterate_recovery() was not.

Signed-off-by: Scott Mayhew <smayhew@redhat.com>
---
 utils/nfsdcld/sqlite.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/utils/nfsdcld/sqlite.c b/utils/nfsdcld/sqlite.c
index 09518e2..6666c86 100644
--- a/utils/nfsdcld/sqlite.c
+++ b/utils/nfsdcld/sqlite.c
@@ -1337,7 +1337,7 @@ sqlite_iterate_recovery(int (*cb)(struct cld_client=
 *clnt), struct cld_client *c
 		cmsg->cm_u.cm_clntinfo.cc_name.cn_len =3D sqlite3_column_bytes(stmt, 0=
);
 		if (sqlite3_column_bytes(stmt, 1) > 0) {
 			memcpy(&cmsg->cm_u.cm_clntinfo.cc_princhash.cp_data,
-				sqlite3_column_blob(stmt, 1), NFS4_OPAQUE_LIMIT);
+				sqlite3_column_blob(stmt, 1), SHA256_DIGEST_SIZE);
 			cmsg->cm_u.cm_clntinfo.cc_princhash.cp_len =3D sqlite3_column_bytes(s=
tmt, 1);
 		}
 #else
--=20
2.25.1