The nfsm_srvpathsiz() macro in nfsrv_symlink() in nfs_serv.c should
check length of the pathname in the range 0<=n<=NFS_MAXPATHLEN, not 0<n<=NFS_MAXPATHLEN. This fixes a minor interoperability problem that the FreeBSD NFS server did not allow a symlink pointing the empty pathname. MFC after: 1 week
This commit is contained in:
parent
3b62120e87
commit
9235ff6373
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=165739
@ -1360,6 +1360,24 @@ nfsm_srvnamesiz_xx(int *s, int m, struct mbuf **md, caddr_t *dpos)
|
||||
return 0;
|
||||
}
|
||||
|
||||
int
|
||||
nfsm_srvnamesiz0_xx(int *s, int m, struct mbuf **md, caddr_t *dpos)
|
||||
{
|
||||
u_int32_t *tl;
|
||||
|
||||
NFSD_LOCK_DONTCARE();
|
||||
|
||||
tl = nfsm_dissect_xx_nonblock(NFSX_UNSIGNED, md, dpos);
|
||||
if (tl == NULL)
|
||||
return EBADRPC;
|
||||
*s = fxdr_unsigned(int32_t, *tl);
|
||||
if (*s > m)
|
||||
return NFSERR_NAMETOL;
|
||||
if (*s < 0)
|
||||
return EBADRPC;
|
||||
return 0;
|
||||
}
|
||||
|
||||
void
|
||||
nfsm_clget_xx(u_int32_t **tl, struct mbuf *mb, struct mbuf **mp,
|
||||
char **bp, char **be, caddr_t bpos, int droplock)
|
||||
|
@ -74,6 +74,7 @@
|
||||
|
||||
int nfsm_srvstrsiz_xx(int *s, int m, struct mbuf **md, caddr_t *dpos);
|
||||
int nfsm_srvnamesiz_xx(int *s, int m, struct mbuf **md, caddr_t *dpos);
|
||||
int nfsm_srvnamesiz0_xx(int *s, int m, struct mbuf **md, caddr_t *dpos);
|
||||
int nfsm_srvmtofh_xx(fhandle_t *f, struct nfsrv_descript *nfsd,
|
||||
struct mbuf **md, caddr_t *dpos);
|
||||
int nfsm_srvsattr_xx(struct vattr *a, struct mbuf **md, caddr_t *dpos);
|
||||
@ -101,7 +102,7 @@ do { \
|
||||
#define nfsm_srvpathsiz(s) \
|
||||
do { \
|
||||
int t1; \
|
||||
t1 = nfsm_srvnamesiz_xx(&(s), NFS_MAXPATHLEN, &md, &dpos); \
|
||||
t1 = nfsm_srvnamesiz0_xx(&(s), NFS_MAXPATHLEN, &md, &dpos); \
|
||||
if (t1) { \
|
||||
error = t1; \
|
||||
nfsm_reply(0); \
|
||||
|
Loading…
Reference in New Issue
Block a user