diff options
| author | Theo de Raadt <deraadt@cvs.openbsd.org> | 1998-02-23 09:46:54 +0000 |
|---|---|---|
| committer | Theo de Raadt <deraadt@cvs.openbsd.org> | 1998-02-23 09:46:54 +0000 |
| commit | a0d558598ba1cd03c653aa0cb8e3210937f1bba1 (patch) | |
| tree | 20d813cc34e3a54d62a45dfdf6bdb6c1f8d50000 /sys/nfs/krpc_subr.c | |
| parent | 54a72b80730eb22de02560be66cf491cc4c64c4e (diff) | |
do not copy from past end of mbuf; found by ivan
Diffstat (limited to 'sys/nfs/krpc_subr.c')
| -rw-r--r-- | sys/nfs/krpc_subr.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/sys/nfs/krpc_subr.c b/sys/nfs/krpc_subr.c index 13fd92f30d6..c7763398ae6 100644 --- a/sys/nfs/krpc_subr.c +++ b/sys/nfs/krpc_subr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: krpc_subr.c,v 1.7 1997/04/27 23:06:01 angelos Exp $ */ +/* $OpenBSD: krpc_subr.c,v 1.8 1998/02/23 09:46:53 deraadt Exp $ */ /* $NetBSD: krpc_subr.c,v 1.12.4.1 1996/06/07 00:52:26 cgd Exp $ */ /* @@ -515,6 +515,10 @@ xdr_string_decode(m, str, len_p) if (slen > *len_p) slen = *len_p; + if (slen > m->m_pkthdr.len) { + m_freem(m); + return (NULL); + } m_copydata(m, 4, slen, str); m_adj(m, mlen); |