Author: kib
Date: Fri Feb 24 11:30:28 2017
New Revision: 314201
URL: https://svnweb.freebsd.org/changeset/base/314201
Log:
MFC r313800:
Do not access memory past the buffer end.
Do not accept and silently truncate too long hostname.
Modified:
stable/10/sys/fs/nfsclient/nfs_clvfsops.c
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/sys/fs/nfsclient/nfs_clvfsops.c
==============================================================================
--- stable/10/sys/fs/nfsclient/nfs_clvfsops.c Fri Feb 24 11:25:32 2017
(r314200)
+++ stable/10/sys/fs/nfsclient/nfs_clvfsops.c Fri Feb 24 11:30:28 2017
(r314201)
@@ -1149,8 +1149,13 @@ nfs_mount(struct mount *mp)
error = EINVAL;
goto out;
}
- bcopy(args.hostname, hst, MNAMELEN);
- hst[MNAMELEN - 1] = '\0';
+ if (len >= MNAMELEN) {
+ vfs_mount_error(mp, "Hostname too long");
+ error = EINVAL;
+ goto out;
+ }
+ bcopy(args.hostname, hst, len);
+ hst[len] = '\0';
}
if (vfs_getopt(mp->mnt_optnew, "principal", (void **)&name, NULL) == 0)
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10
To unsubscribe, send any mail to "[email protected]"
