Module Name: src
Committed By: riastradh
Date: Thu Mar 23 19:52:43 UTC 2023
Modified Files:
src/sys/nfs: nfs_srvsubs.c
Log Message:
nfs: Avoid integer overflow in nfs_namei bounds check.
XXX pullup-8
XXX pullup-9
XXX pullup-10
To generate a diff of this commit:
cvs rdiff -u -r1.16 -r1.17 src/sys/nfs/nfs_srvsubs.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/nfs/nfs_srvsubs.c
diff -u src/sys/nfs/nfs_srvsubs.c:1.16 src/sys/nfs/nfs_srvsubs.c:1.17
--- src/sys/nfs/nfs_srvsubs.c:1.16 Wed Apr 27 17:38:52 2022
+++ src/sys/nfs/nfs_srvsubs.c Thu Mar 23 19:52:42 2023
@@ -1,4 +1,4 @@
-/* $NetBSD: nfs_srvsubs.c,v 1.16 2022/04/27 17:38:52 hannken Exp $ */
+/* $NetBSD: nfs_srvsubs.c,v 1.17 2023/03/23 19:52:42 riastradh Exp $ */
/*
* Copyright (c) 1989, 1993
@@ -70,7 +70,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: nfs_srvsubs.c,v 1.16 2022/04/27 17:38:52 hannken Exp $");
+__KERNEL_RCSID(0, "$NetBSD: nfs_srvsubs.c,v 1.17 2023/03/23 19:52:42 riastradh Exp $");
#include <sys/param.h>
#include <sys/proc.h>
@@ -129,7 +129,7 @@ nfs_namei(struct nameidata *ndp, nfsrvfh
*retdirp = NULL;
ndp->ni_pathbuf = NULL;
- if ((len + 1) > NFS_MAXPATHLEN)
+ if (len > NFS_MAXPATHLEN - 1)
return (ENAMETOOLONG);
if (len == 0)
return (EACCES);
