From 86b9c464000d23c229251d06e9af10b10ab21308 Mon Sep 17 00:00:00 2001 From: ache Date: Thu, 23 Aug 2001 16:13:59 +0000 Subject: [PATCH] Implement l_len<0 per POSIX check. Check for valid l_whence too. --- sys/nfs/nfs_lock.c | 10 ++++++---- sys/nfsclient/nfs_lock.c | 10 ++++++---- 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/sys/nfs/nfs_lock.c b/sys/nfs/nfs_lock.c index ac52410a60b6..607662c62138 100644 --- a/sys/nfs/nfs_lock.c +++ b/sys/nfs/nfs_lock.c @@ -102,12 +102,14 @@ nfs_dolock(ap) * the NLM protocol doesn't allow the server to return an error * on ranges, so we do it. */ - if (fl->l_len < 0) - return (EINVAL); if (fl->l_whence != SEEK_END) { - if (fl->l_start < 0) + if (fl->l_whence != SEEK_CUR || fl->l_whence != SEEK_SET || + fl->l_start < 0 || + (fl->l_len < 0 && + (fl->l_start == 0 || fl->l_start + fl->l_len < 0))) return (EINVAL); - if (fl->l_len != 0 && (fl->l_len - 1 > OFF_MAX - fl->l_start)) + if (fl->l_len > 0 && + (fl->l_len - 1 > OFF_MAX - fl->l_start)) return (EOVERFLOW); } diff --git a/sys/nfsclient/nfs_lock.c b/sys/nfsclient/nfs_lock.c index ac52410a60b6..607662c62138 100644 --- a/sys/nfsclient/nfs_lock.c +++ b/sys/nfsclient/nfs_lock.c @@ -102,12 +102,14 @@ nfs_dolock(ap) * the NLM protocol doesn't allow the server to return an error * on ranges, so we do it. */ - if (fl->l_len < 0) - return (EINVAL); if (fl->l_whence != SEEK_END) { - if (fl->l_start < 0) + if (fl->l_whence != SEEK_CUR || fl->l_whence != SEEK_SET || + fl->l_start < 0 || + (fl->l_len < 0 && + (fl->l_start == 0 || fl->l_start + fl->l_len < 0))) return (EINVAL); - if (fl->l_len != 0 && (fl->l_len - 1 > OFF_MAX - fl->l_start)) + if (fl->l_len > 0 && + (fl->l_len - 1 > OFF_MAX - fl->l_start)) return (EOVERFLOW); }