thebestvibedev/tromcho.net
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add bounds checks to prevent uint32 overflows in NFS/XDR

Browse Source
This commit is contained in:
Vitaliy Filippov
2026-06-17 12:04:50 +03:00
parent 9c49315fdf
commit 3becdbf5b9
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/nfs/proto/xdr_impl_inline.h
+4
View File
@@ -93,6 +93,8 @@ struct XDR
uint32_t inline len_pad4(uint32_t len) uint32_t inline len_pad4(uint32_t len)
{ {
if (len > UINT32_MAX-3)
return UINT32_MAX;
return ((len+3)/4) * 4; return ((len+3)/4) * 4;
} }
@@ -326,6 +328,8 @@ inline int xdr_array(XDR *xdrs, char **data, uint32_t* len, uint32_t maxlen, uin
return 0; return 0;
xdrs->buf += 4; xdrs->buf += 4;
xdrs->avail -= 4; xdrs->avail -= 4;
if (*len > UINT32_MAX/entry_size)
return 0;
*data = (char*)malloc_or_die(entry_size * (*len)); *data = (char*)malloc_or_die(entry_size * (*len));
for (uint32_t i = 0; i < *len; i++) for (uint32_t i = 0; i < *len; i++)
fn(xdrs, *data + entry_size*i); fn(xdrs, *data + entry_size*i);