D53367.1790636549.diff
No OneTemporary
Actions

Size

1 KB

Referenced Files

None

Subscribers

None

D53367.1790636549.diff
View Options

	diff --git a/sys/fs/nfsclient/nfs_clrpcops.c b/sys/fs/nfsclient/nfs_clrpcops.c
	--- a/sys/fs/nfsclient/nfs_clrpcops.c
	+++ b/sys/fs/nfsclient/nfs_clrpcops.c
	@@ -5807,7 +5807,8 @@
	NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
	stripecnt = fxdr_unsigned(int, *tl);
	NFSCL_DEBUG(4, "stripecnt=%d\n", stripecnt);
	- if (stripecnt < 1 \|\| stripecnt > 4096) {
	+ if (stripecnt >= MHLEN / NFSX_UNSIGNED \|\|
	+ stripecnt < 1) {
	printf("pNFS File layout devinfo stripecnt %d:"
	" out of range\n", stripecnt);
	error = NFSERR_BADXDR;
	@@ -8253,7 +8254,7 @@
	NFSPROC_T *p)
	{
	uint32_t *tl;
	- char cp, str, str0[NFSV4_SMALLSTR + 1];
	+ char *str, str0[NFSV4_SMALLSTR + 1];
	uint32_t len = 0;
	int error = 0;

	@@ -8276,9 +8277,9 @@
	str = malloc(len + 1, M_TEMP, M_WAITOK);
	else
	str = str0;
	- NFSM_DISSECT(cp, char *, NFSM_RNDUP(len));
	- NFSBCOPY(cp, str, len);
	- str[len] = '\0';
	+ error = nfsrv_mtostr(nd, str, len);
	+ if (error != 0)
	+ goto nfsmout;
	NFSCL_DEBUG(4, "nfsrv_parseug: str=%s\n", str);
	if (dogrp != 0)
	error = nfsv4_strtogid(nd, str, len, gidp);