Date: Fri, 26 Nov 2021 23:32:07 GMT From: Rick Macklem <rmacklem@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 22f7bcb523e7 - main - nfscl: Sanity check irdcnt in nfsrpc_createsession Message-ID: <202111262332.1AQNW7kL036038@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by rmacklem: URL: https://cgit.FreeBSD.org/src/commit/?id=22f7bcb523e7138248832fb304559c8f23276e08 commit 22f7bcb523e7138248832fb304559c8f23276e08 Author: Rick Macklem <rmacklem@FreeBSD.org> AuthorDate: 2021-11-26 23:28:40 +0000 Commit: Rick Macklem <rmacklem@FreeBSD.org> CommitDate: 2021-11-26 23:28:40 +0000 nfscl: Sanity check irdcnt in nfsrpc_createsession Reported by: rtm@lcs.mit.edu Tested by: rtm@lcs.mit.edu PR: 259996 MFC after: 2 weeks --- sys/fs/nfsclient/nfs_clrpcops.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sys/fs/nfsclient/nfs_clrpcops.c b/sys/fs/nfsclient/nfs_clrpcops.c index f520743e8c32..7646c1b404da 100644 --- a/sys/fs/nfsclient/nfs_clrpcops.c +++ b/sys/fs/nfsclient/nfs_clrpcops.c @@ -5233,6 +5233,10 @@ nfsrpc_createsession(struct nfsmount *nmp, struct nfsclsession *sep, sep->nfsess_foreslots = fxdr_unsigned(uint16_t, *tl++); NFSCL_DEBUG(4, "fore slots=%d\n", (int)sep->nfsess_foreslots); irdcnt = fxdr_unsigned(int, *tl); + if (irdcnt < 0 || irdcnt > 1) { + error = NFSERR_BADXDR; + goto nfsmout; + } if (irdcnt > 0) NFSM_DISSECT(tl, uint32_t *, irdcnt * NFSX_UNSIGNED);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202111262332.1AQNW7kL036038>