D56779.diff
No OneTemporary
Actions

Size

1 KB

Referenced Files

None

Subscribers

None

D56779.diff
View Options

	diff --git a/sys/fs/nfsclient/nfs_clsubs.c b/sys/fs/nfsclient/nfs_clsubs.c
	--- a/sys/fs/nfsclient/nfs_clsubs.c
	+++ b/sys/fs/nfsclient/nfs_clsubs.c
	@@ -263,9 +263,17 @@
	ncl_getcookie(struct nfsnode *np, off_t off, int add)
	{
	struct nfsdmap dp, dp2;
	- int pos;
	+ u_int pos;
	nfsuint64 *retval = NULL;

	+ /*
	+ * Limiting "off" to 50Gbytes sets a limit of 100 million directory
	+ * entries of maximum filename length. Much more with shorter
	+ * file names. This limit ensures "pos" will not be truncated
	+ * in the devision below.
	+ */
	+ if (off > 53687091200ull)
	+ goto out;
	pos = (uoff_t)off / NFS_DIRBLKSIZ;
	if (pos == 0 \|\| off < 0) {
	KASSERT(!add, ("nfs getcookie add at <= 0"));
	diff --git a/sys/fs/nfsclient/nfsnode.h b/sys/fs/nfsclient/nfsnode.h
	--- a/sys/fs/nfsclient/nfsnode.h
	+++ b/sys/fs/nfsclient/nfsnode.h
	@@ -61,7 +61,7 @@

	struct nfsdmap {
	LIST_ENTRY(nfsdmap) ndm_list;
	- int ndm_eocookie;
	+ u_int ndm_eocookie;
	union {
	nfsuint64 ndmu3_cookies[NFSNUMCOOKIES];
	uint64_t ndmu4_cookies[NFSNUMCOOKIES];