[PATCH] NFS: Ensure ACL xdr code doesn't overflow.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] NFS: Ensure ACL xdr code doesn't overflow.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Trond Myklebust · Linus Torvalds
1 parent 75cd968ab2
Showing 3 changed files with 3 additions and 0 deletions Side-by-side Diff
fs/nfs_common/nfsacl.c
include/linux/sunrpc/xdr.h
net/sunrpc/xdr.c
@@ -239,6 +239,7 @@
 	if (xdr_decode_word(buf, base, &entries) ||
 	    entries > NFS_ACL_MAX_ENTRIES)
 		return -EINVAL;
+	nfsacl_desc.desc.array_maxlen = entries;
 	err = xdr_decode_array2(buf, base + 4, &nfsacl_desc.desc);
 	if (err)
 		return err;
@@ -177,6 +177,7 @@
 struct xdr_array2_desc {
 	unsigned int elem_size;
 	unsigned int array_len;
+	unsigned int array_maxlen;
 	xdr_xcode_elem_t xcode;
 };
  
@@ -993,6 +993,7 @@
 			return -EINVAL;
 	} else {
 		if (xdr_decode_word(buf, base, &desc->array_len) != 0 ||
+		    desc->array_len > desc->array_maxlen ||
 		    (unsigned long) base + 4 + desc->array_len *
 				    desc->elem_size > buf->len)
 			return -EINVAL;
...	...	@@ -239,6 +239,7 @@
239	239	if (xdr_decode_word(buf, base, &entries) \|\|
240	240	entries > NFS_ACL_MAX_ENTRIES)
241	241	return -EINVAL;
	242	+ nfsacl_desc.desc.array_maxlen = entries;
242	243	err = xdr_decode_array2(buf, base + 4, &nfsacl_desc.desc);
243	244	if (err)
244	245	return err;
...	...	@@ -177,6 +177,7 @@
177	177	struct xdr_array2_desc {
178	178	unsigned int elem_size;
179	179	unsigned int array_len;
	180	+ unsigned int array_maxlen;
180	181	xdr_xcode_elem_t xcode;
181	182	};
182	183
...	...	@@ -993,6 +993,7 @@
993	993	return -EINVAL;
994	994	} else {
995	995	if (xdr_decode_word(buf, base, &desc->array_len) != 0 \|\|
	996	+ desc->array_len > desc->array_maxlen \|\|
996	997	(unsigned long) base + 4 + desc->array_len *
997	998	desc->elem_size > buf->len)
998	999	return -EINVAL;