View | Details | Raw Unified | Return to bug 260155
Collapse All | Expand All

(-)sys/fs/nfs/nfs_commonsubs.c (+9 lines)
Lines 2187-2192 nfsv4_loadattr(struct nfsrv_descript *nd, vnode_t vp, Link Here
2187
			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2187
			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2188
			attrsum += NFSX_UNSIGNED;
2188
			attrsum += NFSX_UNSIGNED;
2189
			i = fxdr_unsigned(int, *tl);
2189
			i = fxdr_unsigned(int, *tl);
2190
			/*
2191
			 * The RFCs do not define an upper limit for the
2192
			 * number of layout types, but 32 should be more
2193
			 * than enough.
2194
			 */
2195
			if (i < 0 || i > 32) {
2196
				error = NFSERR_BADXDR;
2197
				goto nfsmout;
2198
			}
2190
			if (i > 0) {
2199
			if (i > 0) {
2191
				NFSM_DISSECT(tl, u_int32_t *, i *
2200
				NFSM_DISSECT(tl, u_int32_t *, i *
2192
				    NFSX_UNSIGNED);
2201
				    NFSX_UNSIGNED);

Return to bug 260155