diff options
| author | liucheng (G) <[email protected]> | 2019-08-29 13:47:54 +0000 |
|---|---|---|
| committer | Joe Hershberger <[email protected]> | 2019-09-04 11:37:19 -0500 |
| commit | cf3a4f1e86ecdd24f87b615051b49d8e1968c230 (patch) | |
| tree | 7ccee6d442944ff635fc3962b67ce641c104dd78 /net | |
| parent | aa207cf3a6d68f39d64cd29057a4fb63943e9078 (diff) | |
CVE-2019-14195: nfs: fix unbounded memcpy with unvalidated length at nfs_readlink_reply
This patch adds a check to rpc_pkt.u.reply.data at nfs_readlink_reply.
Signed-off-by: Cheng Liu <[email protected]>
Reported-by: FermÃn Serna <[email protected]>
Acked-by: Joe Hershberger <[email protected]>
Diffstat (limited to 'net')
| -rw-r--r-- | net/nfs.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/nfs.c b/net/nfs.c index 11941fad1ac..915acd95cf8 100644 --- a/net/nfs.c +++ b/net/nfs.c @@ -634,6 +634,9 @@ static int nfs_readlink_reply(uchar *pkt, unsigned len) /* new path length */ rlen = ntohl(rpc_pkt.u.reply.data[1 + nfsv3_data_offset]); + if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + rlen) > len) + return -NFS_RPC_DROP; + if (*((char *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset])) != '/') { int pathlen; |