vhaudiquet/u-boot-krane
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

net: nfs: clean up bounds checks in nfs_readlink_reply()

Browse Source 
Commit d6694018ea ("net: nfs: fix buffer overflow in
nfs_readlink_reply()") added bounds checks against sizeof(nfs_path_buff)
before both memcpy() calls. This is a cosmetic cleanup of that fix:

- introduce a local new_len for the relative-path branch so the sum
  pathlen + rlen is computed once and reused for both the bounds check
  and the NUL terminator, rather than being open-coded twice;
- emit a diagnostic when a symlink target is rejected for exceeding the
  buffer, matching the style of other NFS error paths.

No functional change to the accept/reject decision.

This same overflow was independently discovered and privately reported
to the U-Boot maintainers on 2026-04-03, together with a working proof
of concept, ahead of the change that became the fix cited above. This
cleanup restores the local-variable form from that original report.

Signed-off-by: Murtaza Munaim <murtaza@saramena.us>
This commit is contained in:
Murtaza Munaim
2026-07-23 17:18:37 +02:00
committed by Jerome Forissier
parent f517fdbc0d
commit 85d82c5232
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/nfs-common.c
+9 -3
View File
@@ -671,18 +671,24 @@ static int nfs_readlink_reply(uchar *pkt, unsigned int len)
if (*((char *)&rpc_pkt.u.reply.data[2 + nfsv3_data_offset]) != '/') {
int pathlen;
int new_len;
strcat(nfs_path, "/");
pathlen = strlen(nfs_path);
if (pathlen + rlen >= sizeof(nfs_path_buff))
new_len = pathlen + rlen;
if (new_len >= sizeof(nfs_path_buff)) {
printf("NFS: symlink too long (%d bytes)\n", new_len);
return -NFS_RPC_DROP;
}
memcpy(nfs_path + pathlen,
(uchar *)&rpc_pkt.u.reply.data[2 + nfsv3_data_offset],
rlen);
nfs_path[pathlen + rlen] = 0;
nfs_path[new_len] = 0;
} else {
if (rlen >= sizeof(nfs_path_buff))
if (rlen >= sizeof(nfs_path_buff)) {
printf("NFS: symlink too long (%d bytes)\n", rlen);
return -NFS_RPC_DROP;
}
memcpy(nfs_path,
(uchar *)&rpc_pkt.u.reply.data[2 + nfsv3_data_offset],
rlen);