Messages in this thread | | | From | David Howells <> | Subject | Re: [PATCH] NFS: Check lengths more thoroughly in NFS4 readdir XDR decode | Date | Thu, 24 Aug 2006 19:35:21 +0100 |
| |
So, what you've done is:
-+ if (end - p < xlen) ++ if (end - p < xlen + 1) goto short_pkt; + dprintk("filename = %*s\n", len, (char *)p); + p += xlen; len = ntohl(*p++); /* bitmap length */ - p += len; - if (p + 1 > end) -+ if (end - p < len) ++ if (end - p < len + 1) goto short_pkt; + p += len; attrlen = XDR_QUADLEN(ntohl(*p++)); - p += attrlen; /* attributes */ - if (p + 2 > end) -+ if (end - p < attrlen + 1) ++ if (end - p < attrlen + 2)
But is this equivalent:
-+ if (end - p < xlen) ++ if (end - p <= xlen) goto short_pkt; + dprintk("filename = %*s\n", len, (char *)p); + p += xlen; len = ntohl(*p++); /* bitmap length */ - p += len; - if (p + 1 > end) -+ if (end - p < len) ++ if (end - p <= len) goto short_pkt; + p += len; attrlen = XDR_QUADLEN(ntohl(*p++)); - p += attrlen; /* attributes */ - if (p + 2 > end) -+ if (end - p < attrlen + 1) ++ if (end - p <= attrlen + 1)
Do you think?
David - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |