2 files changed, 7 insertions, 0 deletions
diff --git a/sunrpc/svc_tcp.c b/sunrpc/svc_tcp.c
index 8d728bd47d..41f95332e7 100644
--- a/sunrpc/svc_tcp.c
+++ b/sunrpc/svc_tcp.c
@@ -387,6 +387,7 @@ svctcp_recv (xprt, msg)
       cd->x_id = msg->rm_xid;
       return (TRUE);
     }
+  cd->strm_stat = XPRT_DIED;	/* XXXX */
   return (FALSE);
 }
 
diff --git a/sunrpc/xdr_rec.c b/sunrpc/xdr_rec.c
index db5684bcab..f855b3d90e 100644
--- a/sunrpc/xdr_rec.c
+++ b/sunrpc/xdr_rec.c
@@ -567,6 +567,12 @@ set_input_fragment (RECSTREAM *rstrm)
     return FALSE;
   header = ntohl (header);
   rstrm->last_frag = ((header & LAST_FRAG) == 0) ? FALSE : TRUE;
+  /*
+   * Sanity check. Try not to accept wildly incorrect
+   * record sizes.
+   */
+  if ((header & (~LAST_FRAG)) > rstrm->recvsize)
+    return(FALSE);
   rstrm->fbtbc = header & ~LAST_FRAG;
   return TRUE;
 }