Author: emaste
Date: Fri Nov 23 20:32:41 2018
New Revision: 340851
URL: https://svnweb.freebsd.org/changeset/base/340851
Log:
MFC r340663 (rmacklem):
Improve sanity checking for the dircount hint argument to
NFSv3's ReaddirPlus and NFSv4's Readdir operations. The code
checked for a zero argument, but did not check for a very large value.
This patch clips dircount at the server's maximum data size.
Modified:
stable/12/sys/fs/nfsserver/nfs_nfsdport.c
Directory Properties:
stable/12/ (props changed)
Modified: stable/12/sys/fs/nfsserver/nfs_nfsdport.c
==============================================================================
--- stable/12/sys/fs/nfsserver/nfs_nfsdport.c Fri Nov 23 20:31:27 2018
(r340850)
+++ stable/12/sys/fs/nfsserver/nfs_nfsdport.c Fri Nov 23 20:32:41 2018
(r340851)
@@ -2107,9 +2107,15 @@ nfsrvd_readdirplus(struct nfsrv_descript *nd, int isdg
* cookie) should be in the reply. At least one client "hints" 0,
* so I set it to cnt for that case. I also round it up to the
* next multiple of DIRBLKSIZ.
+ * Since the size of a Readdirplus directory entry reply will always
+ * be greater than a directory entry returned by VOP_READDIR(), it
+ * does not make sense to read more than NFS_SRVMAXDATA() via
+ * VOP_READDIR().
*/
if (siz <= 0)
siz = cnt;
+ else if (siz > NFS_SRVMAXDATA(nd))
+ siz = NFS_SRVMAXDATA(nd);
siz = ((siz + DIRBLKSIZ - 1) & ~(DIRBLKSIZ - 1));
if (nd->nd_flag & ND_NFSV4) {
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
