From 6e2e03a2cffea3bf4c764d6294888318e0566b7d Mon Sep 17 00:00:00 2001 From: Yury Luneff Date: Fri, 16 Oct 2026 09:00:37 +0300 Subject: [PATCH] NFS: Do not memcpy from NULL when encoding an empty opaque xdr_bytes() copied data->size bytes from data->data even when the size was 0, and an empty opaque (for example the AUTH_NONE verifier of every RPC reply) has a NULL data pointer. memcpy() with a NULL source is undefined behaviour even for 0 bytes; UBSan (-fsanitize=undefined) stops the NFS server at its first reply. --- src/nfs/proto/xdr_impl_inline.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/nfs/proto/xdr_impl_inline.h b/src/nfs/proto/xdr_impl_inline.h index 9fdbcea0..d724e228 100644 --- a/src/nfs/proto/xdr_impl_inline.h +++ b/src/nfs/proto/xdr_impl_inline.h @@ -159,7 +159,8 @@ inline int xdr_bytes(XDR *xdrs, xdr_string_t *data, uint32_t maxlen, bool rdma_c unsigned old = xdrs->cur_out.size(); xdrs->cur_out.resize(old + 4+data->size); *(uint32_t*)(xdrs->cur_out.data() + old) = htobe32(data->size); - memcpy(xdrs->cur_out.data()+old+4, data->data, data->size); + if (data->size) + memcpy(xdrs->cur_out.data()+old+4, data->data, data->size); } else { -- 2.47.3