[PATCH] Fix BZ #218

[Jakub Jelinek <jakub at redhat dot com>]

Hi!

By saving address of pml_next we actually did not help ourselves at all,
next still points into freed memory after xdr_reference and thus cannot be
read nor written.
The patch in bugzilla doesn't help much, it adds to a read from freed
memory in xdr_reference also a write into freed memory.

2004-06-14  Jakub Jelinek  <jakub@redhat.com>

	[BZ #218]
	* sunrpc/pmap_prot2.c (xdr_pmaplist): When freeing, remember pml_next
	in a local variable, point rp to that local variable afterwards.

--- libc/sunrpc/pmap_prot2.c.jj	2002-02-26 02:43:56.000000000 +0100
+++ libc/sunrpc/pmap_prot2.c	2004-06-14 15:01:45.489088043 +0200
@@ -93,7 +93,7 @@ xdr_pmaplist (xdrs, rp)
    */
   bool_t more_elements;
   int freeing = (xdrs->x_op == XDR_FREE);
-  struct pmaplist **next = NULL;
+  struct pmaplist *next = NULL;
 
   while (TRUE)
     {
@@ -108,12 +108,12 @@ xdr_pmaplist (xdrs, rp)
        * before we free the current object ...
        */
       if (freeing)
-	next = &((*rp)->pml_next);
+	next = (*rp)->pml_next;
       if (!INTUSE(xdr_reference) (xdrs, (caddr_t *) rp,
 				  (u_int) sizeof (struct pmaplist),
 				  (xdrproc_t) INTUSE(xdr_pmap)))
 	  return FALSE;
-      rp = freeing ? next : &((*rp)->pml_next);
+      rp = freeing ? &next : &((*rp)->pml_next);
     }
 }
 INTDEF(xdr_pmaplist)

	Jakub