FreeBSD Bugzilla – Attachment 229735 Details for
Bug 260046
An NFS v4 client can crash the server with a LISTXATTRS RPC
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
Handle the case of a small maxcount < minimum reply
crash2.patch (text/plain), 700 bytes, created by
Rick Macklem
on 2021-11-26 02:56:11 UTC
(
hide
)
Description:
Handle the case of a small maxcount < minimum reply
Filename:
MIME Type:
Creator:
Rick Macklem
Created:
2021-11-26 02:56:11 UTC
Size:
700 bytes
patch
obsolete
>--- sys/fs/nfsserver/nfs_nfsdserv.c.crash2 2021-11-25 16:00:19.885995000 -0800 >+++ sys/fs/nfsserver/nfs_nfsdserv.c 2021-11-25 16:26:35.413949000 -0800 >@@ -6077,10 +6077,12 @@ nfsrvd_listxattr(struct nfsrv_descript *nd, __unused i > if (cookie2 < cookie) > nd->nd_repstat = NFSERR_BADXDR; > } >+ retlen = NFSX_HYPER + 2 * NFSX_UNSIGNED; >+ if (nd->nd_repstat == 0 && len == 0 && len2 < retlen) >+ nd->nd_repstat = NFSERR_TOOSMALL; > if (nd->nd_repstat == 0) { > /* Now copy the entries out. */ >- retlen = NFSX_HYPER + 2 * NFSX_UNSIGNED; >- if (len == 0 && retlen <= len2) { >+ if (len == 0) { > /* The cookie was at eof. */ > NFSM_BUILD(tl, uint32_t *, NFSX_HYPER + 2 * > NFSX_UNSIGNED);
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=229735">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 260046
:
229724
| 229735