Commit 409da088 authored by Neil Brown's avatar Neil Brown Committed by Linus Torvalds

[PATCH] knfsd: svcrpc: fqdn length fix

Problem identified by Jan Kasprzak.

Limit on domainname_max (currently 50) is too small.

Just use the beginning of input buffer as scratch space for it, and save a
little stack space while we're at it.
Signed-off-by: default avatarJ. Bruce Fields <bfields@citi.umich.edu>
Signed-off-by: default avatarNeil Brown <neilb@cse.unsw.edu.au>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 375e63f7
...@@ -150,11 +150,14 @@ static void ip_map_request(struct cache_detail *cd, ...@@ -150,11 +150,14 @@ static void ip_map_request(struct cache_detail *cd,
} }
static struct ip_map *ip_map_lookup(struct ip_map *, int); static struct ip_map *ip_map_lookup(struct ip_map *, int);
static int ip_map_parse(struct cache_detail *cd, static int ip_map_parse(struct cache_detail *cd,
char *mesg, int mlen) char *mesg, int mlen)
{ {
/* class ipaddress [domainname] */ /* class ipaddress [domainname] */
char class[50], buf[50]; /* should be safe just to use the start of the input buffer
* for scratch: */
char *buf = mesg;
int len; int len;
int b1,b2,b3,b4; int b1,b2,b3,b4;
char c; char c;
...@@ -167,13 +170,11 @@ static int ip_map_parse(struct cache_detail *cd, ...@@ -167,13 +170,11 @@ static int ip_map_parse(struct cache_detail *cd,
mesg[mlen-1] = 0; mesg[mlen-1] = 0;
/* class */ /* class */
len = qword_get(&mesg, class, 50); len = qword_get(&mesg, ipm.m_class, sizeof(ipm.m_class));
if (len <= 0) return -EINVAL; if (len <= 0) return -EINVAL;
if (len >= sizeof(ipm.m_class))
return -EINVAL;
/* ip address */ /* ip address */
len = qword_get(&mesg, buf, 50); len = qword_get(&mesg, buf, mlen);
if (len <= 0) return -EINVAL; if (len <= 0) return -EINVAL;
if (sscanf(buf, "%u.%u.%u.%u%c", &b1, &b2, &b3, &b4, &c) != 4) if (sscanf(buf, "%u.%u.%u.%u%c", &b1, &b2, &b3, &b4, &c) != 4)
...@@ -184,7 +185,7 @@ static int ip_map_parse(struct cache_detail *cd, ...@@ -184,7 +185,7 @@ static int ip_map_parse(struct cache_detail *cd,
return -EINVAL; return -EINVAL;
/* domainname, or empty for NEGATIVE */ /* domainname, or empty for NEGATIVE */
len = qword_get(&mesg, buf, 50); len = qword_get(&mesg, buf, mlen);
if (len < 0) return -EINVAL; if (len < 0) return -EINVAL;
if (len) { if (len) {
...@@ -194,7 +195,6 @@ static int ip_map_parse(struct cache_detail *cd, ...@@ -194,7 +195,6 @@ static int ip_map_parse(struct cache_detail *cd,
} else } else
dom = NULL; dom = NULL;
strcpy(ipm.m_class, class);
ipm.m_addr.s_addr = ipm.m_addr.s_addr =
htonl((((((b1<<8)|b2)<<8)|b3)<<8)|b4); htonl((((((b1<<8)|b2)<<8)|b3)<<8)|b4);
ipm.h.flags = 0; ipm.h.flags = 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment