diff options
| author | Trond Myklebust <Trond.Myklebust@netapp.com> | 2005-08-10 18:15:12 -0400 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2005-08-16 08:52:11 -0700 |
| commit | 58fcb8df0bf663bb6b8f46cd3010bfe8d13d97cf (patch) | |
| tree | 24edbecfb5875cf6c602b1fd5126c7dfce9ae127 /net/sunrpc/xdr.c | |
| parent | 75cd968ab251ac84dd3a5dc252af7036dc4a64f4 (diff) | |
[PATCH] NFS: Ensure ACL xdr code doesn't overflow.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'net/sunrpc/xdr.c')
| -rw-r--r-- | net/sunrpc/xdr.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c index 8a4d9c106af..fde16f40a58 100644 --- a/net/sunrpc/xdr.c +++ b/net/sunrpc/xdr.c @@ -993,6 +993,7 @@ xdr_xcode_array2(struct xdr_buf *buf, unsigned int base, return -EINVAL; } else { if (xdr_decode_word(buf, base, &desc->array_len) != 0 || + desc->array_len > desc->array_maxlen || (unsigned long) base + 4 + desc->array_len * desc->elem_size > buf->len) return -EINVAL; |