upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-05-28 04:12:45 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

nfsd: Sanity check the Layouttype count

Browse source 
PR:	260155

(cherry picked from commit 480be96e1e)
This commit is contained in:
Rick Macklem 2021-12-04 14:18:48 -08:00
parent 606b6ce485
commit fac8422a41
1 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
sys/fs/nfs/nfs_commonsubs.c
View file

@ -2186,6 +2186,15 @@ nfsv4_loadattr(struct nfsrv_descript *nd, vnode_t vp,
NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
attrsum += NFSX_UNSIGNED;
i = fxdr_unsigned(int, *tl);
/*
* The RFCs do not define an upper limit for the
* number of layout types, but 32 should be more
* than enough.
*/
if (i < 0 || i > 32) {
error = NFSERR_BADXDR;
goto nfsmout;
}
if (i > 0) {
NFSM_DISSECT(tl, u_int32_t *, i *
NFSX_UNSIGNED);