[PATCH] NFS: Ensure ACL xdr code doesn't overflow.
Trond Myklebust [Wed, 10 Aug 2005 22:15:12 +0000 (18:15 -0400)]
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

fs/nfs_common/nfsacl.c
include/linux/sunrpc/xdr.h
net/sunrpc/xdr.c

index 18c58c3..251e5a1 100644 (file)
@@ -239,6 +239,7 @@ nfsacl_decode(struct xdr_buf *buf, unsigned int base, unsigned int *aclcnt,
        if (xdr_decode_word(buf, base, &entries) ||
            entries > NFS_ACL_MAX_ENTRIES)
                return -EINVAL;
+       nfsacl_desc.desc.array_maxlen = entries;
        err = xdr_decode_array2(buf, base + 4, &nfsacl_desc.desc);
        if (err)
                return err;
index 34ec3e8..23448d0 100644 (file)
@@ -177,6 +177,7 @@ typedef int (*xdr_xcode_elem_t)(struct xdr_array2_desc *desc, void *elem);
 struct xdr_array2_desc {
        unsigned int elem_size;
        unsigned int array_len;
+       unsigned int array_maxlen;
        xdr_xcode_elem_t xcode;
 };
 
index 8a4d9c1..fde16f4 100644 (file)
@@ -993,6 +993,7 @@ xdr_xcode_array2(struct xdr_buf *buf, unsigned int base,
                        return -EINVAL;
        } else {
                if (xdr_decode_word(buf, base, &desc->array_len) != 0 ||
+                   desc->array_len > desc->array_maxlen ||
                    (unsigned long) base + 4 + desc->array_len *
                                    desc->elem_size > buf->len)
                        return -EINVAL;