diff options
| author | J. Bruce Fields <bfields@redhat.com> | 2016-02-29 20:21:21 -0500 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2016-05-01 00:05:52 +0200 |
| commit | c3a74faca4f65baf01acdf6efe0a61c774113b8c (patch) | |
| tree | 1351008ec796f7cf4cd962815d929d29f3186e80 /include | |
| parent | 55e1a2e5b1dff966a6484d85514a7c0daf8a0205 (diff) | |
nfsd4: fix bad bounds checking
commit 4aed9c46afb80164401143aa0fdcfe3798baa9d5 upstream.
A number of spots in the xdr decoding follow a pattern like
n = be32_to_cpup(p++);
READ_BUF(n + 4);
where n is a u32. The only bounds checking is done in READ_BUF itself,
but since it's checking (n + 4), it won't catch cases where n is very
large, (u32)(-4) or higher. I'm not sure exactly what the consequences
are, but we've seen crashes soon after.
Instead, just break these up into two READ_BUF()s.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions