From 67dec77024c313901d0686f0d57d80814003449b Mon Sep 17 00:00:00 2001 From: Neil Brown Date: Mon, 4 Aug 2003 23:19:58 -0700 Subject: [PATCH] [PATCH] Protect against NFS requests to create symlinks bigger than one page Such a request would cause the nul terminator to be written to some other page, and cause havoc. Also rearrange two tests to avoid the possibility of testing the byte just past the end of a buffer - doing so can causes an oops with appropriate kernel-debug config options --- fs/nfsd/nfs3xdr.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c index 2e53ddd839358..02798d4b8cd83 100644 --- a/fs/nfsd/nfs3xdr.c +++ b/fs/nfsd/nfs3xdr.c @@ -446,7 +446,7 @@ nfs3svc_decode_symlinkargs(struct svc_rqst *rqstp, u32 *p, */ svc_take_page(rqstp); len = ntohl(*p++); - if (len <= 0 || len > NFS3_MAXPATHLEN) + if (len <= 0 || len > NFS3_MAXPATHLEN || len >= PAGE_SIZE) return 0; args->tname = new = page_address(rqstp->rq_respages[rqstp->rq_resused-1]); args->tlen = len; @@ -454,7 +454,7 @@ nfs3svc_decode_symlinkargs(struct svc_rqst *rqstp, u32 *p, old = (char*)p; vec = &rqstp->rq_arg.head[0]; avail = vec->iov_len - (old - (char*)vec->iov_base); - while (len > 0 && *old && avail) { + while (len && avail && *old) { *new++ = *old++; len--; avail--; @@ -465,7 +465,7 @@ nfs3svc_decode_symlinkargs(struct svc_rqst *rqstp, u32 *p, if (avail > PAGE_SIZE) avail = PAGE_SIZE; old = page_address(rqstp->rq_arg.pages[0]); } - while (len > 0 && *old && avail) { + while (len && avail && *old) { *new++ = *old++; len--; avail--; -- 2.53.0