diff options
| author | Rick Macklem <rmacklem@FreeBSD.org> | 2021-11-26 23:28:40 +0000 |
|---|---|---|
| committer | Rick Macklem <rmacklem@FreeBSD.org> | 2021-11-26 23:28:40 +0000 |
| commit | 22f7bcb523e7138248832fb304559c8f23276e08 (patch) | |
| tree | 1287ab63b10c68d005dce117d6d9319ef73b7b70 | |
| parent | 1879021942f56c8b264f4aeb1966b3733908ef62 (diff) | |
| download | src-22f7bcb523e7138248832fb304559c8f23276e08.tar.gz src-22f7bcb523e7138248832fb304559c8f23276e08.zip | |
nfscl: Sanity check irdcnt in nfsrpc_createsession
Reported by: rtm@lcs.mit.edu
Tested by: rtm@lcs.mit.edu
PR: 259996
MFC after: 2 weeks
| -rw-r--r-- | sys/fs/nfsclient/nfs_clrpcops.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/sys/fs/nfsclient/nfs_clrpcops.c b/sys/fs/nfsclient/nfs_clrpcops.c index f520743e8c32..7646c1b404da 100644 --- a/sys/fs/nfsclient/nfs_clrpcops.c +++ b/sys/fs/nfsclient/nfs_clrpcops.c @@ -5233,6 +5233,10 @@ nfsrpc_createsession(struct nfsmount *nmp, struct nfsclsession *sep, sep->nfsess_foreslots = fxdr_unsigned(uint16_t, *tl++); NFSCL_DEBUG(4, "fore slots=%d\n", (int)sep->nfsess_foreslots); irdcnt = fxdr_unsigned(int, *tl); + if (irdcnt < 0 || irdcnt > 1) { + error = NFSERR_BADXDR; + goto nfsmout; + } if (irdcnt > 0) NFSM_DISSECT(tl, uint32_t *, irdcnt * NFSX_UNSIGNED); |