8098 Some xdr_simple(3nsl) and xdr_complex(3nsl) functions can succeed for undefined xdrs->x_op values

Reviewed by: Yuri Pankov <yuri.pankov@gmail.com>
Reviewed by: Jason King <jason.brian.king+illumos@gmail.com>
Reviewed by: Vitaliy Gusev <gusev.vitaliy@icloud.com>
Approved by: Robert Mustacchi <rm@joyent.com>

3 files changed, 26 insertions, 25 deletions

diff --git a/usr/src/lib/libnsl/rpc/xdr.c b/usr/src/lib/libnsl/rpc/xdr.c
index 6d5095ff11..dd1314046c 100644
--- a/usr/src/lib/libnsl/rpc/xdr.c
+++ b/usr/src/lib/libnsl/rpc/xdr.c
@@ -33,8 +33,6 @@
  * California.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 /*
  * Generic XDR routines implementation.
  *
@@ -383,12 +381,6 @@ xdr_opaque(XDR *xdrs, caddr_t cp, const uint_t cnt)
 	char crud[BYTES_PER_XDR_UNIT];
 
 	/*
-	 * if no data we are done
-	 */
-	if (cnt == 0)
-		return (TRUE);
-
-	/*
 	 * round byte count to full xdr units
 	 */
 	rndup = cnt % BYTES_PER_XDR_UNIT;
@@ -488,7 +480,7 @@ xdr_netobj(XDR *xdrs, struct netobj *np)
  */
 bool_t
 xdr_union(XDR *xdrs, enum_t *dscmp, char *unp,
-		const struct xdr_discrim *choices, const xdrproc_t dfault)
+    const struct xdr_discrim *choices, const xdrproc_t dfault)
 {
 	enum_t dscm;
 
@@ -617,38 +609,39 @@ xdr_string(XDR *xdrs, char **cpp, const uint_t maxsize)
 bool_t
 xdr_hyper(XDR *xdrs, longlong_t *hp)
 {
-	if (xdrs->x_op == XDR_ENCODE) {
+	switch (xdrs->x_op) {
+	case XDR_ENCODE:
 #if defined(_LONG_LONG_HTOL)
 		if (XDR_PUTINT32(xdrs, (int *)hp) == TRUE)
 			/* LINTED pointer cast */
 			return (XDR_PUTINT32(xdrs, (int *)((char *)hp +
-				BYTES_PER_XDR_UNIT)));
+			    BYTES_PER_XDR_UNIT)));
 #else
 		/* LINTED pointer cast */
 		if (XDR_PUTINT32(xdrs, (int *)((char *)hp +
-				BYTES_PER_XDR_UNIT)) == TRUE)
+		    BYTES_PER_XDR_UNIT)) == TRUE)
 			return (XDR_PUTINT32(xdrs, (int32_t *)hp));
 #endif
 		return (FALSE);
-	}
-
-	if (xdrs->x_op == XDR_DECODE) {
+	case XDR_DECODE:
 #if defined(_LONG_LONG_HTOL)
 		if (XDR_GETINT32(xdrs, (int *)hp) == FALSE ||
 		    /* LINTED pointer cast */
 		    (XDR_GETINT32(xdrs, (int *)((char *)hp +
-				BYTES_PER_XDR_UNIT)) == FALSE))
+		    BYTES_PER_XDR_UNIT)) == FALSE))
 			return (FALSE);
 #else
 		/* LINTED pointer cast */
 		if ((XDR_GETINT32(xdrs, (int *)((char *)hp +
-				BYTES_PER_XDR_UNIT)) == FALSE) ||
-				(XDR_GETINT32(xdrs, (int *)hp) == FALSE))
+		    BYTES_PER_XDR_UNIT)) == FALSE) ||
+		    (XDR_GETINT32(xdrs, (int *)hp) == FALSE))
 			return (FALSE);
 #endif
 		return (TRUE);
+	case XDR_FREE:
+		return (TRUE);
 	}
-	return (TRUE);
+	return (FALSE);
 }
 
 bool_t
diff --git a/usr/src/lib/libnsl/rpc/xdr_array.c b/usr/src/lib/libnsl/rpc/xdr_array.c
index c3b4508e31..80e49cff4d 100644
--- a/usr/src/lib/libnsl/rpc/xdr_array.c
+++ b/usr/src/lib/libnsl/rpc/xdr_array.c
@@ -33,8 +33,6 @@
  * California.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 /*
  * Generic XDR routines impelmentation.
  *
@@ -65,7 +63,7 @@ char mem_err_msg_arr[] = "xdr_array: out of memory";
  */
 bool_t
 xdr_array(XDR *xdrs, caddr_t *addrp, uint_t *sizep, const uint_t maxsize,
-	const uint_t elsize, const xdrproc_t elproc)
+    const uint_t elsize, const xdrproc_t elproc)
 {
 	uint_t i;
 	caddr_t target = *addrp;
@@ -133,11 +131,17 @@ xdr_array(XDR *xdrs, caddr_t *addrp, uint_t *sizep, const uint_t maxsize,
  */
 bool_t
 xdr_vector(XDR *xdrs, char *basep, const uint_t nelem,
-	const uint_t elemsize, const xdrproc_t xdr_elem)
+    const uint_t elemsize, const xdrproc_t xdr_elem)
 {
 	uint_t i;
 	char *elptr;
 
+	/* Make sure x_op contains a valid value */
+	if (xdrs->x_op != XDR_ENCODE &&
+	    xdrs->x_op != XDR_DECODE &&
+	    xdrs->x_op != XDR_FREE)
+		return (FALSE);
+
 	elptr = basep;
 	for (i = 0; i < nelem; i++) {
 		if (!(*xdr_elem)(xdrs, elptr, LASTUNSIGNED))
diff --git a/usr/src/lib/libnsl/rpc/xdr_refer.c b/usr/src/lib/libnsl/rpc/xdr_refer.c
index e3be8f2529..c20ee180af 100644
--- a/usr/src/lib/libnsl/rpc/xdr_refer.c
+++ b/usr/src/lib/libnsl/rpc/xdr_refer.c
@@ -33,8 +33,6 @@
  * California.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 /*
  * Generic XDR routines impelmentation.
  *
@@ -68,6 +66,12 @@ xdr_reference(XDR *xdrs, caddr_t *pp, uint_t size, const xdrproc_t proc)
 	caddr_t loc = *pp;
 	bool_t stat;
 
+	/* Make sure x_op contains a valid value */
+	if (xdrs->x_op != XDR_ENCODE &&
+	    xdrs->x_op != XDR_DECODE &&
+	    xdrs->x_op != XDR_FREE)
+		return (FALSE);
+
 	if (loc == NULL)
 		switch (xdrs->x_op) {
 		case XDR_FREE: