diff options
| author | Rick Macklem <rmacklem@FreeBSD.org> | 2025-10-27 14:43:02 +0000 |
|---|---|---|
| committer | Rick Macklem <rmacklem@FreeBSD.org> | 2025-10-27 14:43:02 +0000 |
| commit | b9e6206f593385c80436d267ab759319c1e94e43 (patch) | |
| tree | 53d1b06da3b0b2d07e42f6b33f1a4c4e83e524df | |
| parent | 3053b2a3dcab6e05311c3b696bee4c9e5698d93a (diff) | |
nfs_clrpcops.c: Fix two possible large NFSM_DISSECT()s
There are two cases in nfs_clrpcops.c where it was possible
for the code to attempt to NFSM_DISSECT() a large size,
which is not allowed by nfsm_dissct().
This patch fixes them.
Reducing the maximum stripecnt should be no problem,
since there in no extant NFSv4.n server that does striped
File Layout pNFS and current development is centered
around the Flex File layout.
Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Reviewed by: markj
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D53367
| -rw-r--r-- | sys/fs/nfsclient/nfs_clrpcops.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/sys/fs/nfsclient/nfs_clrpcops.c b/sys/fs/nfsclient/nfs_clrpcops.c index d9f27c3f31a2..c8a130c34412 100644 --- a/sys/fs/nfsclient/nfs_clrpcops.c +++ b/sys/fs/nfsclient/nfs_clrpcops.c @@ -5807,7 +5807,8 @@ nfsrpc_getdeviceinfo(struct nfsmount *nmp, uint8_t *deviceid, int layouttype, NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED); stripecnt = fxdr_unsigned(int, *tl); NFSCL_DEBUG(4, "stripecnt=%d\n", stripecnt); - if (stripecnt < 1 || stripecnt > 4096) { + if (stripecnt >= MHLEN / NFSX_UNSIGNED || + stripecnt < 1) { printf("pNFS File layout devinfo stripecnt %d:" " out of range\n", stripecnt); error = NFSERR_BADXDR; @@ -8253,7 +8254,7 @@ nfsrv_parseug(struct nfsrv_descript *nd, int dogrp, uid_t *uidp, gid_t *gidp, NFSPROC_T *p) { uint32_t *tl; - char *cp, *str, str0[NFSV4_SMALLSTR + 1]; + char *str, str0[NFSV4_SMALLSTR + 1]; uint32_t len = 0; int error = 0; @@ -8276,9 +8277,9 @@ nfsrv_parseug(struct nfsrv_descript *nd, int dogrp, uid_t *uidp, gid_t *gidp, str = malloc(len + 1, M_TEMP, M_WAITOK); else str = str0; - NFSM_DISSECT(cp, char *, NFSM_RNDUP(len)); - NFSBCOPY(cp, str, len); - str[len] = '\0'; + error = nfsrv_mtostr(nd, str, len); + if (error != 0) + goto nfsmout; NFSCL_DEBUG(4, "nfsrv_parseug: str=%s\n", str); if (dogrp != 0) error = nfsv4_strtogid(nd, str, len, gidp); |