lkml.org 
[lkml]   [2005]   [Sep]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] nfs client, kernel 2.4.31: readlink result overflow
Assar wrote:

>>The 2.6 kernel code is also broken, but in a different, but once again,
>>similar fashions.
>>
>>
>
>You mean for length > 1024 ?
>
>diff -u linux-2.6.13.orig/fs/nfs/nfs2xdr.c linux-2.6.13/fs/nfs/nfs2xdr.c
>--- linux-2.6.13.orig/fs/nfs/nfs2xdr.c 2005-08-28 19:41:01.000000000 -0400
>+++ linux-2.6.13/fs/nfs/nfs2xdr.c 2005-09-14 15:40:13.000000000 -0400
>@@ -557,7 +557,7 @@
> return -nfs_stat_to_errno(status);
> /* Convert length of symlink */
> len = ntohl(*p++);
>- if (len >= rcvbuf->page_len || len <= 0) {
>+ if (len >= rcvbuf->page_len || len <= 0 || len > NFS2_MAXPATHLEN) {
> dprintk(KERN_WARNING "nfs: server returned giant symlink!\n");
> return -ENAMETOOLONG;
> }
>

This code appears to assume that rcvbuf->page_base is zero here, but then
uses rcvbuf->page_base when calculating where to place the null byte. It
seems to me that it should either use rcvbuf->page_base in both
calculations or neither.

Thanx...

ps
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-09-14 22:21    [W:0.049 / U:0.052 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site