Author: rmacklem
Date: Tue Nov 20 01:59:57 2018
New Revision: 340663
URL: https://svnweb.freebsd.org/changeset/base/340663
Log:
Improve sanity checking for the dircount hint argument to
NFSv3's ReaddirPlus and NFSv4's Readdir operations. The code
checked for a zero argument, but did not check for a very large value.
This patch clips dircount at the server's maximum data size.
MFC after: 1 week
Modified:
head/sys/fs/nfsserver/nfs_nfsdport.c
Modified: head/sys/fs/nfsserver/nfs_nfsdport.c
==============================================================================
--- head/sys/fs/nfsserver/nfs_nfsdport.c Tue Nov 20 01:56:34 2018
(r340662)
+++ head/sys/fs/nfsserver/nfs_nfsdport.c Tue Nov 20 01:59:57 2018
(r340663)
@@ -2107,9 +2107,15 @@ nfsrvd_readdirplus(struct nfsrv_descript *nd, int isdg
* cookie) should be in the reply. At least one client "hints" 0,
* so I set it to cnt for that case. I also round it up to the
* next multiple of DIRBLKSIZ.
+ * Since the size of a Readdirplus directory entry reply will always
+ * be greater than a directory entry returned by VOP_READDIR(), it
+ * does not make sense to read more than NFS_SRVMAXDATA() via
+ * VOP_READDIR().
*/
if (siz <= 0)
siz = cnt;
+ else if (siz > NFS_SRVMAXDATA(nd))
+ siz = NFS_SRVMAXDATA(nd);
siz = ((siz + DIRBLKSIZ - 1) & ~(DIRBLKSIZ - 1));
if (nd->nd_flag & ND_NFSV4) {
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
