diff options
author | liucheng (G) <liucheng32@huawei.com> | 2019-08-29 16:47:54 +0300 |
---|---|---|
committer | Joe Hershberger <joe.hershberger@ni.com> | 2019-09-04 19:37:19 +0300 |
commit | cf3a4f1e86ecdd24f87b615051b49d8e1968c230 (patch) | |
tree | 7ccee6d442944ff635fc3962b67ce641c104dd78 | |
parent | aa207cf3a6d68f39d64cd29057a4fb63943e9078 (diff) | |
download | u-boot-cf3a4f1e86ecdd24f87b615051b49d8e1968c230.tar.xz |
CVE-2019-14195: nfs: fix unbounded memcpy with unvalidated length at nfs_readlink_reply
This patch adds a check to rpc_pkt.u.reply.data at nfs_readlink_reply.
Signed-off-by: Cheng Liu <liucheng32@huawei.com>
Reported-by: FermÃn Serna <fermin@semmle.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
-rw-r--r-- | net/nfs.c | 3 |
1 files changed, 3 insertions, 0 deletions
@@ -634,6 +634,9 @@ static int nfs_readlink_reply(uchar *pkt, unsigned len) /* new path length */ rlen = ntohl(rpc_pkt.u.reply.data[1 + nfsv3_data_offset]); + if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + rlen) > len) + return -NFS_RPC_DROP; + if (*((char *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset])) != '/') { int pathlen; |