View | Details | Raw Unified | Return to bug 260266
Collapse All | Expand All

(-)sys/fs/nfsclient/nfs_clstate.c (-1 / +2 lines)
Lines 3531-3538 nfscl_docb(struct nfsrv_descript *nd, NFSPROC_T *p) Link Here
3531 
	nfsrvd_rephead(nd);
 3531 
	nfsrvd_rephead(nd);
3532 
	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 3532 
	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3533 
	taglen = fxdr_unsigned(int, *tl);
 3533 
	taglen = fxdr_unsigned(int, *tl);
3534 
	if (taglen < 0) {
 3534 
	if (taglen < 0 || taglen > NFSV4_OPAQUELIMIT) {
3535 
		error = EBADRPC;
 3535 
		error = EBADRPC;
3536 
		taglen = -1;
3536 
		goto nfsmout;
 3537 
		goto nfsmout;
3537 
	}
 3538 
	}
3538 
	if (taglen <= NFSV4_SMALLSTR)
 3539 
	if (taglen <= NFSV4_SMALLSTR)

Return to bug 260266