diff options
| author |   deraadt <deraadt@openbsd.org> | 1998-02-23 09:46:53 +0000 |
|---|---|---|
| committer | deraadt <deraadt@openbsd.org> | 1998-02-23 09:46:53 +0000 |
| commit | 59c8e5fe23fb2c33e7c1147c8e238fc5ad45a68c (patch) | |
| tree | 0d857bb9158cc8f5c4c7dcef8699dd8e063d8c8f | |
| parent | GCC 2.8 -Wall (diff) | |
| download | wireguard-openbsd-59c8e5fe23fb2c33e7c1147c8e238fc5ad45a68c.tar.xz wireguard-openbsd-59c8e5fe23fb2c33e7c1147c8e238fc5ad45a68c.zip | |
do not copy from past end of mbuf; found by ivan
| -rw-r--r-- | sys/nfs/krpc_subr.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/sys/nfs/krpc_subr.c b/sys/nfs/krpc_subr.c index 13fd92f30d6..c7763398ae6 100644 --- a/sys/nfs/krpc_subr.c +++ b/sys/nfs/krpc_subr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: krpc_subr.c,v 1.7 1997/04/27 23:06:01 angelos Exp $ */ +/* $OpenBSD: krpc_subr.c,v 1.8 1998/02/23 09:46:53 deraadt Exp $ */ /* $NetBSD: krpc_subr.c,v 1.12.4.1 1996/06/07 00:52:26 cgd Exp $ */ /* @@ -515,6 +515,10 @@ xdr_string_decode(m, str, len_p) if (slen > *len_p) slen = *len_p; + if (slen > m->m_pkthdr.len) { + m_freem(m); + return (NULL); + } m_copydata(m, 4, slen, str); m_adj(m, mlen); |