mirror of
https://github.com/opnsense/src.git
synced 2026-05-28 04:12:45 -04:00
96f65d85d4
The NFSv4.2 Allocate operation sanity checks the aa_offset
and aa_length arguments. Since they are assigned to variables
of type off_t (signed) it was possible for them to be negative.
It was also possible for aa_offset+aa_length to exceed OFF_MAX
when stored in lo_end, which is uint64_t.
This patch adds checks for these cases to the sanity check.
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| nfs_fha_new.c | ||
| nfs_fha_new.h | ||
| nfs_nfsdcache.c | ||
| nfs_nfsdkrpc.c | ||
| nfs_nfsdport.c | ||
| nfs_nfsdserv.c | ||
| nfs_nfsdsocket.c | ||
| nfs_nfsdstate.c | ||
| nfs_nfsdsubs.c | ||