diff options
| author | simon <simon@FreeBSD.org> | 2006-03-01 14:17:32 +0000 |
|---|---|---|
| committer | simon <simon@FreeBSD.org> | 2006-03-01 14:17:32 +0000 |
| commit | 1b31e5fc10af56b71e0636186451840a46c3fe03 (patch) | |
| tree | 147337fb2ac27de625b256c2d0a2544178f118d4 /sys/nfsserver | |
| parent | 8d6d9efea21efa48fe2a41ecffba3cb4edf6eed8 (diff) | |
| download | FreeBSD-src-1b31e5fc10af56b71e0636186451840a46c3fe03.zip FreeBSD-src-1b31e5fc10af56b71e0636186451840a46c3fe03.tar.gz | |
Correct a remote kernel panic when processing zero-length RPC records
via TCP. [06:10]
Security: FreeBSD-SA-06:10.nfs
Approved by: cperciva
Diffstat (limited to 'sys/nfsserver')
| -rw-r--r-- | sys/nfsserver/nfs_srvsock.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/nfsserver/nfs_srvsock.c b/sys/nfsserver/nfs_srvsock.c index b17474c..50c7cbf 100644 --- a/sys/nfsserver/nfs_srvsock.c +++ b/sys/nfsserver/nfs_srvsock.c @@ -592,7 +592,7 @@ nfsrv_getstream(struct nfssvc_sock *slp, int waitflag) slp->ns_flag |= SLP_LASTFRAG; else slp->ns_flag &= ~SLP_LASTFRAG; - if (slp->ns_reclen > NFS_MAXPACKET) { + if (slp->ns_reclen > NFS_MAXPACKET || slp->ns_reclen <= 0) { slp->ns_flag &= ~SLP_GETSTREAM; return (EPERM); } |
