diff options
| author | kib <kib@FreeBSD.org> | 2017-02-24 11:30:28 +0000 |
|---|---|---|
| committer | kib <kib@FreeBSD.org> | 2017-02-24 11:30:28 +0000 |
| commit | ade5533c9e8c6be99eb55fca8b577967e97bc7ef (patch) | |
| tree | b5803f6915dcea0fd3d376c34ee4b861139bd8f9 /sys/fs | |
| parent | 0de9168a4c22f52771eb7bcee3afdda0c5ae5f07 (diff) | |
| download | FreeBSD-src-ade5533c9e8c6be99eb55fca8b577967e97bc7ef.zip FreeBSD-src-ade5533c9e8c6be99eb55fca8b577967e97bc7ef.tar.gz | |
MFC r313800:
Do not access memory past the buffer end.
Do not accept and silently truncate too long hostname.
Diffstat (limited to 'sys/fs')
| -rw-r--r-- | sys/fs/nfsclient/nfs_clvfsops.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/sys/fs/nfsclient/nfs_clvfsops.c b/sys/fs/nfsclient/nfs_clvfsops.c index 075981b..67beb76 100644 --- a/sys/fs/nfsclient/nfs_clvfsops.c +++ b/sys/fs/nfsclient/nfs_clvfsops.c @@ -1149,8 +1149,13 @@ nfs_mount(struct mount *mp) error = EINVAL; goto out; } - bcopy(args.hostname, hst, MNAMELEN); - hst[MNAMELEN - 1] = '\0'; + if (len >= MNAMELEN) { + vfs_mount_error(mp, "Hostname too long"); + error = EINVAL; + goto out; + } + bcopy(args.hostname, hst, len); + hst[len] = '\0'; } if (vfs_getopt(mp->mnt_optnew, "principal", (void **)&name, NULL) == 0) |
