[Bug network/22114] xdr_char() and xdr_u_char() functions crashes on encoding of character lying in constant memory segment

["a.kampling at gmx dot de" <sourceware-bugzilla at sourceware dot org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=22114

--- Comment #3 from Andre Kampling <a.kampling at gmx dot de> ---
(In reply to Florian Weimer from comment #2)
> (In reply to Andre Kampling from comment #1)
> > Created attachment 10419 [details]
> > Patch of xdr.c ("xdr_char()" and "xdr_u_char()")
> > 
> > Here is a patch of the "xdr_char()" and "xdr_u_char()" functions based on
> > the behaviour of the other functions like "xdr_int()", "xdr_long()", etc.
> 
> Patches should be posted to the mailing list.  The XDR_DECODE part seems to
> be broken because it does not actually decode anything.

Hello Florian,
thank your for your reply!

I didn't know that about the mailing list. I'm a little bit confused why
patches should be posted there because if I want to add an atachment here there
is a patch checkbox...

But anyways, the patch I provided does not seem broken to me. The decoding
takes place by "*cp = u;" or "*cp = i;" in the "case XDR_DECODE:" block. It is
exactly like the other functions do that.

Further why you flag this as security?

-- 
You are receiving this mail because:
You are on the CC list for the bug.