Author: sbruno Date: Fri Jul 22 03:09:47 2016 New Revision: 303173 URL: https://svnweb.freebsd.org/changeset/base/303173
Log: MFC r298351 Avoid a possible heap overflow in our nlm code by limiting the number of service to the arbitrary value of 256. Log an appropriate message that indicates the hard limit. Modified: stable/10/sys/nlm/nlm_prot_impl.c Modified: stable/10/sys/nlm/nlm_prot_impl.c ============================================================================== --- stable/10/sys/nlm/nlm_prot_impl.c Fri Jul 22 03:03:52 2016 (r303172) +++ stable/10/sys/nlm/nlm_prot_impl.c Fri Jul 22 03:09:47 2016 (r303173) @@ -1439,6 +1439,12 @@ nlm_register_services(SVCPOOL *pool, int return (EINVAL); } + if (addr_count < 0 || addr_count > 256 ) { + NLM_ERR("NLM: too many service addresses (%d) given, " + "max 256 - can't start server\n", addr_count); + return (EINVAL); + } + xprts = malloc(addr_count * sizeof(SVCXPRT *), M_NLM, M_WAITOK|M_ZERO); for (i = 0; i < version_count; i++) { for (j = 0; j < addr_count; j++) { _______________________________________________ svn-src-all@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-all To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"