Re: [PATCH] nfs client, kernel 2.4.31: readlink result overflow

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Assar wrote:

The 2.6 kernel code is also broken, but in a different, but once again,
similar fashions.

You mean for length > 1024 ?

diff -u linux-2.6.13.orig/fs/nfs/nfs2xdr.c linux-2.6.13/fs/nfs/nfs2xdr.c
--- linux-2.6.13.orig/fs/nfs/nfs2xdr.c	2005-08-28 19:41:01.000000000 -0400
+++ linux-2.6.13/fs/nfs/nfs2xdr.c	2005-09-14 15:40:13.000000000 -0400
@@ -557,7 +557,7 @@
		return -nfs_stat_to_errno(status);
	/* Convert length of symlink */
	len = ntohl(*p++);
-	if (len >= rcvbuf->page_len || len <= 0) {
+	if (len >= rcvbuf->page_len || len <= 0 || len > NFS2_MAXPATHLEN) {
		dprintk(KERN_WARNING "nfs: server returned giant symlink!\n");
		return -ENAMETOOLONG;
	}


This code appears to assume that rcvbuf->page_base is zero here, but then
uses rcvbuf->page_base when calculating where to place the null byte.  It
seems to me that it should either use rcvbuf->page_base in both
calculations or neither.

   Thanx...

      ps
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[Index of Archives]     [Kernel Newbies]     [Netfilter]     [Bugtraq]     [Photo]     [Gimp]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Video 4 Linux]     [Linux for the blind]
  Powered by Linux