Correct a remote kernel panic when processing zero-length RPC records

via TCP. [06:10]

Security:	FreeBSD-SA-06:10.nfs
Approved by:	cperciva
This commit is contained in:
Simon L. B. Nielsen 2006-03-01 14:17:32 +00:00
parent f1fb209627
commit 925374d453

View File

@ -592,7 +592,7 @@ nfsrv_getstream(struct nfssvc_sock *slp, int waitflag)
slp->ns_flag |= SLP_LASTFRAG;
else
slp->ns_flag &= ~SLP_LASTFRAG;
if (slp->ns_reclen > NFS_MAXPACKET) {
if (slp->ns_reclen > NFS_MAXPACKET || slp->ns_reclen <= 0) {
slp->ns_flag &= ~SLP_GETSTREAM;
return (EPERM);
}