diff options
| author | Murtaza Munaim <[email protected]> | 2026-07-22 23:44:29 +0200 |
|---|---|---|
| committer | Jerome Forissier <[email protected]> | 2026-07-23 17:18:37 +0200 |
| commit | 85d82c52327552da9e9bd103342d970d49ec262c (patch) | |
| tree | c239ac2b8f84b3e4465de2523fd2a54289f5355b /contrib/apps/httpserver | |
| parent | f517fdbc0ddcb9bdcb773640f164ddcb924d877c (diff) | |
net: nfs: clean up bounds checks in nfs_readlink_reply()
Commit d6694018eadd ("net: nfs: fix buffer overflow in
nfs_readlink_reply()") added bounds checks against sizeof(nfs_path_buff)
before both memcpy() calls. This is a cosmetic cleanup of that fix:
- introduce a local new_len for the relative-path branch so the sum
pathlen + rlen is computed once and reused for both the bounds check
and the NUL terminator, rather than being open-coded twice;
- emit a diagnostic when a symlink target is rejected for exceeding the
buffer, matching the style of other NFS error paths.
No functional change to the accept/reject decision.
This same overflow was independently discovered and privately reported
to the U-Boot maintainers on 2026-04-03, together with a working proof
of concept, ahead of the change that became the fix cited above. This
cleanup restores the local-variable form from that original report.
Signed-off-by: Murtaza Munaim <[email protected]>
Diffstat (limited to 'contrib/apps/httpserver')
0 files changed, 0 insertions, 0 deletions
