git: 911a1cc05e76 - stable/12 - nfscl: Sanity check irdcnt in nfsrpc_createsession

[Rick Macklem]

The branch stable/12 has been updated by rmacklem:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=911a1cc05e7618a90438178fae28c02e77cda64f

commit 911a1cc05e7618a90438178fae28c02e77cda64f
Author:     Rick Macklem <rmack...@freebsd.org>
AuthorDate: 2021-11-26 23:28:40 +0000
Commit:     Rick Macklem <rmack...@freebsd.org>
CommitDate: 2021-12-10 01:01:16 +0000

    nfscl: Sanity check irdcnt in nfsrpc_createsession
    
    PR:     259996
    
    (cherry picked from commit 22f7bcb523e7138248832fb304559c8f23276e08)
---
 sys/fs/nfsclient/nfs_clrpcops.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sys/fs/nfsclient/nfs_clrpcops.c b/sys/fs/nfsclient/nfs_clrpcops.c
index 9cfab016eecb..df3039239e59 100644
--- a/sys/fs/nfsclient/nfs_clrpcops.c
+++ b/sys/fs/nfsclient/nfs_clrpcops.c
@@ -4879,6 +4879,10 @@ nfsrpc_createsession(struct nfsmount *nmp, struct 
nfsclsession *sep,
                sep->nfsess_foreslots = fxdr_unsigned(uint16_t, *tl++);
                NFSCL_DEBUG(4, "fore slots=%d\n", (int)sep->nfsess_foreslots);
                irdcnt = fxdr_unsigned(int, *tl);
+               if (irdcnt < 0 || irdcnt > 1) {
+                       error = NFSERR_BADXDR;
+                       goto nfsmout;
+               }
                if (irdcnt > 0)
                        NFSM_DISSECT(tl, uint32_t *, irdcnt * NFSX_UNSIGNED);