FreeBSD Bugzilla – Attachment 229868 Details for
Bug 260155
inadequate LAYOUTTYPE sanity check in nfsv4_loadattr()
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
sanity check the count of layouttypes in attributes
crash6.patch (text/plain), 635 bytes, created by
Rick Macklem
on 2021-12-04 01:25:28 UTC
(
hide
)
Description:
sanity check the count of layouttypes in attributes
Filename:
MIME Type:
Creator:
Rick Macklem
Created:
2021-12-04 01:25:28 UTC
Size:
635 bytes
patch
obsolete
>--- sys/fs/nfs/nfs_commonsubs.c.crash6 2021-12-03 16:05:35.535950000 -0800 >+++ sys/fs/nfs/nfs_commonsubs.c 2021-12-03 16:09:57.274566000 -0800 >@@ -2187,6 +2187,15 @@ nfsv4_loadattr(struct nfsrv_descript *nd, vnode_t vp, > NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED); > attrsum += NFSX_UNSIGNED; > i = fxdr_unsigned(int, *tl); >+ /* >+ * The RFCs do not define an upper limit for the >+ * number of layout types, but 32 should be more >+ * than enough. >+ */ >+ if (i < 0 || i > 32) { >+ error = NFSERR_BADXDR; >+ goto nfsmout; >+ } > if (i > 0) { > NFSM_DISSECT(tl, u_int32_t *, i * > NFSX_UNSIGNED);
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=229868">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 260155
:
229829
| 229868