summaryrefslogtreecommitdiff
path: root/net/sunrpc
diff options
context:
space:
mode:
authorTrond Myklebust <Trond.Myklebust@netapp.com>2005-08-10 22:15:12 (GMT)
committerLinus Torvalds <torvalds@g5.osdl.org>2005-08-16 15:52:11 (GMT)
commit58fcb8df0bf663bb6b8f46cd3010bfe8d13d97cf (patch)
tree24edbecfb5875cf6c602b1fd5126c7dfce9ae127 /net/sunrpc
parent75cd968ab251ac84dd3a5dc252af7036dc4a64f4 (diff)
downloadlinux-58fcb8df0bf663bb6b8f46cd3010bfe8d13d97cf.tar.xz
[PATCH] NFS: Ensure ACL xdr code doesn't overflow.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'net/sunrpc')
-rw-r--r--net/sunrpc/xdr.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 8a4d9c1..fde16f4 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -993,6 +993,7 @@ xdr_xcode_array2(struct xdr_buf *buf, unsigned int base,
return -EINVAL;
} else {
if (xdr_decode_word(buf, base, &desc->array_len) != 0 ||
+ desc->array_len > desc->array_maxlen ||
(unsigned long) base + 4 + desc->array_len *
desc->elem_size > buf->len)
return -EINVAL;