diff options
| author | liucheng (G) <liucheng32@huawei.com> | 2019-08-29 13:47:54 +0000 |
|---|---|---|
| committer | Joe Hershberger <joe.hershberger@ni.com> | 2019-09-04 11:37:19 -0500 |
| commit | cf3a4f1e86ecdd24f87b615051b49d8e1968c230 (patch) | |
| tree | 7ccee6d442944ff635fc3962b67ce641c104dd78 /net | |
| parent | aa207cf3a6d68f39d64cd29057a4fb63943e9078 (diff) | |
| download | u-boot-cf3a4f1e86ecdd24f87b615051b49d8e1968c230.tar.gz u-boot-cf3a4f1e86ecdd24f87b615051b49d8e1968c230.tar.bz2 u-boot-cf3a4f1e86ecdd24f87b615051b49d8e1968c230.zip | |
CVE-2019-14195: nfs: fix unbounded memcpy with unvalidated length at nfs_readlink_reply
This patch adds a check to rpc_pkt.u.reply.data at nfs_readlink_reply.
Signed-off-by: Cheng Liu <liucheng32@huawei.com>
Reported-by: FermÃn Serna <fermin@semmle.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/nfs.c | 3 |
1 files changed, 3 insertions, 0 deletions
@@ -634,6 +634,9 @@ static int nfs_readlink_reply(uchar *pkt, unsigned len) /* new path length */ rlen = ntohl(rpc_pkt.u.reply.data[1 + nfsv3_data_offset]); + if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + rlen) > len) + return -NFS_RPC_DROP; + if (*((char *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset])) != '/') { int pathlen; |