FreeBSD Bugzilla – Attachment 229981 Details for
Bug 260266
NFS callback RPC with negative taglen can crash client
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
properly sanity check the callback taglen
crash8.patch (text/plain), 488 bytes, created by
Rick Macklem
on 2021-12-08 21:58:11 UTC
(
hide
)
Description:
properly sanity check the callback taglen
Filename:
MIME Type:
Creator:
Rick Macklem
Created:
2021-12-08 21:58:11 UTC
Size:
488 bytes
patch
obsolete
>--- sys/fs/nfsclient/nfs_clstate.c.crash8 2021-12-08 12:06:01.472604000 -0800 >+++ sys/fs/nfsclient/nfs_clstate.c 2021-12-08 12:13:31.846248000 -0800 >@@ -3531,8 +3531,9 @@ nfscl_docb(struct nfsrv_descript *nd, NFSPROC_T *p) > nfsrvd_rephead(nd); > NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED); > taglen = fxdr_unsigned(int, *tl); >- if (taglen < 0) { >+ if (taglen < 0 || taglen > NFSV4_OPAQUELIMIT) { > error = EBADRPC; >+ taglen = -1; > goto nfsmout; > } > if (taglen <= NFSV4_SMALLSTR)
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=229981">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 260266
:
229961
| 229981