Date: Sat, 4 Dec 2021 22:25:22 GMT From: Rick Macklem <rmacklem@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 480be96e1e24 - main - nfsd: Sanity check the Layouttype count Message-ID: <202112042225.1B4MPMSE006843@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by rmacklem: URL: https://cgit.FreeBSD.org/src/commit/?id=480be96e1e24617f0f152256d7453f60774fd1f3 commit 480be96e1e24617f0f152256d7453f60774fd1f3 Author: Rick Macklem <rmacklem@FreeBSD.org> AuthorDate: 2021-12-04 22:18:48 +0000 Commit: Rick Macklem <rmacklem@FreeBSD.org> CommitDate: 2021-12-04 22:22:19 +0000 nfsd: Sanity check the Layouttype count Reported by: rtm@lcs.mit.edu Tested by: rtm@lcs.mit.edu PR: 260155 MFC after: 2 weeks --- sys/fs/nfs/nfs_commonsubs.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/sys/fs/nfs/nfs_commonsubs.c b/sys/fs/nfs/nfs_commonsubs.c index d882d248ef7f..550dda43afa6 100644 --- a/sys/fs/nfs/nfs_commonsubs.c +++ b/sys/fs/nfs/nfs_commonsubs.c @@ -2186,6 +2186,15 @@ nfsv4_loadattr(struct nfsrv_descript *nd, vnode_t vp, NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED); attrsum += NFSX_UNSIGNED; i = fxdr_unsigned(int, *tl); + /* + * The RFCs do not define an upper limit for the + * number of layout types, but 32 should be more + * than enough. + */ + if (i < 0 || i > 32) { + error = NFSERR_BADXDR; + goto nfsmout; + } if (i > 0) { NFSM_DISSECT(tl, u_int32_t *, i * NFSX_UNSIGNED);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202112042225.1B4MPMSE006843>