From f8dcc5a8f7df80493d95e3fd990ce0b9bc3dec06 Mon Sep 17 00:00:00 2001 From: Doug Rabson Date: Fri, 7 Nov 2008 10:43:01 +0000 Subject: Range-check NFSv2 procedure numbers before converting to NFSv3. Submitted by: csjp --- sys/nfsserver/nfs_fha.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'sys/nfsserver') diff --git a/sys/nfsserver/nfs_fha.c b/sys/nfsserver/nfs_fha.c index a2e4ca3afcf7..66e1d3fe679f 100644 --- a/sys/nfsserver/nfs_fha.c +++ b/sys/nfsserver/nfs_fha.c @@ -180,11 +180,16 @@ fha_extract_info(struct svc_req *req, struct fha_info *i) i->locktype = LK_EXCLUSIVE; /* - * Extract the procnum and convert to v3 form if necessary. + * Extract the procnum and convert to v3 form if necessary, + * taking care to deal with out-of-range procnums. Caller will + * ensure that rq_vers is either 2 or 3. */ procnum = req->rq_proc; - if (!v3) + if (!v3) { + if (procnum > NFSV2PROC_STATFS) + goto out; procnum = nfsrv_nfsv3_procid[procnum]; + } /* * We do affinity for most. However, we divide a realm of affinity -- cgit v1.3