diff options
| author | Rick Macklem <rmacklem@FreeBSD.org> | 2021-11-26 23:56:29 +0000 |
|---|---|---|
| committer | Rick Macklem <rmacklem@FreeBSD.org> | 2021-12-11 02:26:22 +0000 |
| commit | 5b76a6b862ad5ea35c3f9a4572b6388acdfd3de7 (patch) | |
| tree | 7e2477d8dd2f7a91a16ed5a5bfeadf0357bc1a2c | |
| parent | efb381caf102938d24149f38e98881d282ded11a (diff) | |
| download | src-5b76a6b862ad5ea35c3f9a4572b6388acdfd3de7.tar.gz src-5b76a6b862ad5ea35c3f9a4572b6388acdfd3de7.zip | |
nfsd: Sanity check the len argument for ListXattr
The check for the original len being >= retlen needs to
be done before the "if (nd->nd_repstat == 0)" code, so
that it can be reported as too small.
PR: 260046
(cherry picked from commit 5b430a132330bd4a4ea37780807947f3800d009e)
| -rw-r--r-- | sys/fs/nfsserver/nfs_nfsdserv.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/sys/fs/nfsserver/nfs_nfsdserv.c b/sys/fs/nfsserver/nfs_nfsdserv.c index 4ca49f75fc2c..517741a45288 100644 --- a/sys/fs/nfsserver/nfs_nfsdserv.c +++ b/sys/fs/nfsserver/nfs_nfsdserv.c @@ -5990,10 +5990,12 @@ nfsrvd_listxattr(struct nfsrv_descript *nd, __unused int isdgram, if (cookie2 < cookie) nd->nd_repstat = NFSERR_BADXDR; } + retlen = NFSX_HYPER + 2 * NFSX_UNSIGNED; + if (nd->nd_repstat == 0 && len2 < retlen) + nd->nd_repstat = NFSERR_TOOSMALL; if (nd->nd_repstat == 0) { /* Now copy the entries out. */ - retlen = NFSX_HYPER + 2 * NFSX_UNSIGNED; - if (len == 0 && retlen <= len2) { + if (len == 0) { /* The cookie was at eof. */ NFSM_BUILD(tl, uint32_t *, NFSX_HYPER + 2 * NFSX_UNSIGNED); |