Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 58fcb8df authored by Trond Myklebust's avatar Trond Myklebust Committed by Linus Torvalds
Browse files

[PATCH] NFS: Ensure ACL xdr code doesn't overflow. 



Signed-off-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 75cd968a

fs/nfs_common/nfsacl.c

+1 −0
Original line number Diff line number Diff line
@@ -239,6 +239,7 @@ nfsacl_decode(struct xdr_buf *buf, unsigned int base, unsigned int *aclcnt, 
	if (xdr_decode_word(buf, base, &entries) ||

	    entries > NFS_ACL_MAX_ENTRIES)

		return -EINVAL;

	nfsacl_desc.desc.array_maxlen = entries;

	err = xdr_decode_array2(buf, base + 4, &nfsacl_desc.desc);

	if (err)

		return err;

include/linux/sunrpc/xdr.h

+1 −0
Original line number Diff line number Diff line
@@ -177,6 +177,7 @@ typedef int (*xdr_xcode_elem_t)(struct xdr_array2_desc *desc, void *elem); 
struct xdr_array2_desc {

	unsigned int elem_size;

	unsigned int array_len;

	unsigned int array_maxlen;

	xdr_xcode_elem_t xcode;

};

net/sunrpc/xdr.c

+1 −0
Original line number Diff line number Diff line
@@ -993,6 +993,7 @@ xdr_xcode_array2(struct xdr_buf *buf, unsigned int base, 
			return -EINVAL;

	} else {

		if (xdr_decode_word(buf, base, &desc->array_len) != 0 ||

		    desc->array_len > desc->array_maxlen ||

		    (unsigned long) base + 4 + desc->array_len *

				    desc->elem_size > buf->len)

			return -EINVAL;