D53354.diff
No OneTemporary
Actions

Size

573 B

Referenced Files

None

Subscribers

None

D53354.diff
View Options

	diff --git a/sys/fs/nfsserver/nfs_nfsdserv.c b/sys/fs/nfsserver/nfs_nfsdserv.c
	--- a/sys/fs/nfsserver/nfs_nfsdserv.c
	+++ b/sys/fs/nfsserver/nfs_nfsdserv.c
	@@ -5138,6 +5138,11 @@
	NFSM_DISSECT(tl, uint32_t , 2 NFSX_UNSIGNED);
	layouttype = fxdr_unsigned(int, *tl++);
	maxcnt = fxdr_unsigned(int, *tl);
	+ /* There is no limit in the RFC, so use 1000 as a sanity limit. */
	+ if (maxcnt < 0 \|\| maxcnt > 1000) {
	+ error = NFSERR_BADXDR;
	+ goto nfsmout;
	+ }
	if (maxcnt > 0) {
	layp = malloc(maxcnt + 1, M_TEMP, M_WAITOK);
	error = nfsrv_mtostr(nd, layp, maxcnt);