redonkable/remarkable-linux
redonkable/remarkable-linux
1
0
Fork 0
Code Releases Activity

Orangefs: validate resp.listxattr.returned_count

Browse source 
Signed-off-by: Mike Marshall <hubcap@omnibond.com>
This commit is contained in:
Mike Marshall 2015-12-17 16:11:40 -05:00
parent fef8b67ce6
commit 62441fa53b
1 changed files with 11 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
fs/orangefs/xattr.c
View file

@ -348,6 +348,7 @@ ssize_t orangefs_listxattr(struct dentry *dentry, char *buffer, size_t size)
int count_keys = 0;
int key_size;
int i = 0;
int returned_count = 0;
if (size > 0 && buffer == NULL) {
gossip_err("%s: bogus NULL pointers\n", __func__);
@ -392,10 +393,19 @@ try_again:
if (length == 0)
goto done;
returned_count = new_op->downcall.resp.listxattr.returned_count;
if (returned_count < 0 ||
returned_count >= ORANGEFS_MAX_XATTR_LISTLEN) {
gossip_err("%s: impossible value for returned_count:%d:\n",
__func__,
returned_count);
goto done;
}
/*
* Check to see how much can be fit in the buffer. Fit only whole keys.
*/
for (i = 0; i < new_op->downcall.resp.listxattr.returned_count; i++) {
for (i = 0; i < returned_count; i++) {
if (total + new_op->downcall.resp.listxattr.lengths[i] > size)
goto done;