Messages in this thread | | | Date | Wed, 14 Sep 2005 16:11:17 -0400 | From | Peter Staubach <> | Subject | Re: [PATCH] nfs client, kernel 2.4.31: readlink result overflow |
| |
Assar wrote:
>>The 2.6 kernel code is also broken, but in a different, but once again, >>similar fashions. >> >> > >You mean for length > 1024 ? > >diff -u linux-2.6.13.orig/fs/nfs/nfs2xdr.c linux-2.6.13/fs/nfs/nfs2xdr.c >--- linux-2.6.13.orig/fs/nfs/nfs2xdr.c 2005-08-28 19:41:01.000000000 -0400 >+++ linux-2.6.13/fs/nfs/nfs2xdr.c 2005-09-14 15:40:13.000000000 -0400 >@@ -557,7 +557,7 @@ > return -nfs_stat_to_errno(status); > /* Convert length of symlink */ > len = ntohl(*p++); >- if (len >= rcvbuf->page_len || len <= 0) { >+ if (len >= rcvbuf->page_len || len <= 0 || len > NFS2_MAXPATHLEN) { > dprintk(KERN_WARNING "nfs: server returned giant symlink!\n"); > return -ENAMETOOLONG; > } >
This code appears to assume that rcvbuf->page_base is zero here, but then uses rcvbuf->page_base when calculating where to place the null byte. It seems to me that it should either use rcvbuf->page_base in both calculations or neither.
Thanx...
ps - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |