tree 24edbecfb5875cf6c602b1fd5126c7dfce9ae127
parent 75cd968ab251ac84dd3a5dc252af7036dc4a64f4
author Trond Myklebust <[EMAIL PROTECTED]> Thu, 11 Aug 2005 02:15:12 -0400
committer Linus Torvalds <[EMAIL PROTECTED]> Tue, 16 Aug 2005 22:52:11 -0700
[PATCH] NFS: Ensure ACL xdr code doesn't overflow.
Signed-off-by: Trond Myklebust <[EMAIL PROTECTED]>
Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
fs/nfs_common/nfsacl.c | 1 +
include/linux/sunrpc/xdr.h | 1 +
net/sunrpc/xdr.c | 1 +
3 files changed, 3 insertions(+)
diff --git a/fs/nfs_common/nfsacl.c b/fs/nfs_common/nfsacl.c
--- a/fs/nfs_common/nfsacl.c
+++ b/fs/nfs_common/nfsacl.c
@@ -239,6 +239,7 @@ nfsacl_decode(struct xdr_buf *buf, unsig
if (xdr_decode_word(buf, base, &entries) ||
entries > NFS_ACL_MAX_ENTRIES)
return -EINVAL;
+ nfsacl_desc.desc.array_maxlen = entries;
err = xdr_decode_array2(buf, base + 4, &nfsacl_desc.desc);
if (err)
return err;
diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h
--- a/include/linux/sunrpc/xdr.h
+++ b/include/linux/sunrpc/xdr.h
@@ -177,6 +177,7 @@ typedef int (*xdr_xcode_elem_t)(struct x
struct xdr_array2_desc {
unsigned int elem_size;
unsigned int array_len;
+ unsigned int array_maxlen;
xdr_xcode_elem_t xcode;
};
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -993,6 +993,7 @@ xdr_xcode_array2(struct xdr_buf *buf, un
return -EINVAL;
} else {
if (xdr_decode_word(buf, base, &desc->array_len) != 0 ||
+ desc->array_len > desc->array_maxlen ||
(unsigned long) base + 4 + desc->array_len *
desc->elem_size > buf->len)
return -EINVAL;
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
