Date: Fri, 24 Feb 2017 11:30:28 +0000 (UTC) From: Konstantin Belousov <kib@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r314201 - stable/10/sys/fs/nfsclient Message-ID: <201702241130.v1OBUS3G017886@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: kib Date: Fri Feb 24 11:30:28 2017 New Revision: 314201 URL: https://svnweb.freebsd.org/changeset/base/314201 Log: MFC r313800: Do not access memory past the buffer end. Do not accept and silently truncate too long hostname. Modified: stable/10/sys/fs/nfsclient/nfs_clvfsops.c Directory Properties: stable/10/ (props changed) Modified: stable/10/sys/fs/nfsclient/nfs_clvfsops.c ============================================================================== --- stable/10/sys/fs/nfsclient/nfs_clvfsops.c Fri Feb 24 11:25:32 2017 (r314200) +++ stable/10/sys/fs/nfsclient/nfs_clvfsops.c Fri Feb 24 11:30:28 2017 (r314201) @@ -1149,8 +1149,13 @@ nfs_mount(struct mount *mp) error = EINVAL; goto out; } - bcopy(args.hostname, hst, MNAMELEN); - hst[MNAMELEN - 1] = '\0'; + if (len >= MNAMELEN) { + vfs_mount_error(mp, "Hostname too long"); + error = EINVAL; + goto out; + } + bcopy(args.hostname, hst, len); + hst[len] = '\0'; } if (vfs_getopt(mp->mnt_optnew, "principal", (void **)&name, NULL) == 0)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201702241130.v1OBUS3G017886>