From 5ed9b9642051eb266552add8e2df2e17e7d67c79 Mon Sep 17 00:00:00 2001
From: Rick Macklem <rmacklem@FreeBSD.org>
Date: Mon, 17 May 2010 23:55:38 +0000
Subject: [PATCH] Add a sanity check for a negative args.fhsize to the
 experimental NFS client.

MFC after:	5 days
---
 sys/fs/nfsclient/nfs_clvfsops.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/fs/nfsclient/nfs_clvfsops.c b/sys/fs/nfsclient/nfs_clvfsops.c
index 76154c371803..b2cd92b253a9 100644
--- a/sys/fs/nfsclient/nfs_clvfsops.c
+++ b/sys/fs/nfsclient/nfs_clvfsops.c
@@ -951,7 +951,7 @@ nfs_mount(struct mount *mp)
 
 	if (vfs_getopt(mp->mnt_optnew, "fh", (void **)&args.fh,
 	    &args.fhsize) == 0) {
-		if (args.fhsize > NFSX_FHMAX) {
+		if (args.fhsize < 0 || args.fhsize > NFSX_FHMAX) {
 			vfs_mount_error(mp, "Bad file handle");
 			error = EINVAL;
 			goto out;