From: Mark Vitale <mvitale@sinenomine.net>
Date: Tue, 26 Jun 2018 09:00:25 +0000 (-0400)
Subject: OPENAFS-SA-2018-002 butc: prevent TC_ReadLabel information leak
X-Git-Tag: upstream/1.8.2^2~17
X-Git-Url: https://git.michaelhowe.org/gitweb/?a=commitdiff_plain;h=b7e53b9e9706d63215a1804ed9eca30d69461f03;p=packages%2Fo%2Fopenafs.git

OPENAFS-SA-2018-002 butc: prevent TC_ReadLabel information leak

TC_ReadLabel (backup readlabel) does not initialize its output buffer
completely.  It leaks butc memory contents over the wire:

struct tc_tapeLabel
- up to 32 bytes from member afsname (TC_MAXTAPELEN 32)
- up to 32 bytes from member pname (TC_MAXTAPELEN 32)

Initialize the buffer.

[kaduk@mit.edu: move initialization to the RPC stub]

(cherry picked from commit 52f4d63148323e7d605f9194ff8c1549756e654b)

Change-Id: Ia5d9dd649bdbd45c8b201f344bf55080a55e3392
---

diff --git a/src/butc/tcprocs.c b/src/butc/tcprocs.c
index d41112a80..7154a1843 100644
--- a/src/butc/tcprocs.c
+++ b/src/butc/tcprocs.c
@@ -372,6 +372,7 @@ STC_ReadLabel(struct rx_call *acid, struct tc_tapeLabel *label, afs_uint32 *task
 {
     afs_int32 code;
 
+    memset(label, 0, sizeof(*label));
 #ifdef xbsa
     if (CONF_XBSA)
 	return (TC_BADTASK);	/* ReadLabel does not apply if XBSA */