Changeset 7a0df6b in rtems

Timestamp:

Aug 6, 2015, 2:17:41 AM (5 years ago)

Author:

Nick Withers <nick.withers@…>

Branches:

4.11

Children:

9ccdb1d

Parents:

c9318aa

git-author:

Nick Withers <nick.withers@…> (08/06/15 02:17:41)

git-committer:

Gedare Bloom <gedare@…> (08/06/15 14:49:30)

Message:

Respect 2^{32 - 1 B NFSv2 maximum file size}

closes #2384

File:

• cpukit/libfs/src/nfsclient/src/nfs.c (modified) (4 diffs)

cpukit/libfs/src/nfsclient/src/nfs.c

@@ -70 +70 @@
 #include <string.h>
 #include <stdio.h>
+#include <stdint.h>
 #include <stdlib.h>
 #include <assert.h>
@@ -2452 +2453 @@
         char *in = buffer;
 
+        if (iop->offset < 0) {
+                errno = EINVAL;
+                return -1;
+        }
+
+        if ((uintmax_t) iop->offset >= UINT32_MAX) {
+                errno = EFBIG;
+                return -1;
+        }
+
+        if (count > UINT32_MAX - offset) {
+                count = UINT32_MAX - offset;
+        }
+
         do {
                 size_t chunk = count <= NFS_MAXDATA ? count : NFS_MAXDATA;
@@ -2551 +2566 @@
 
 
-        SERP_ARGS(node).writearg.beginoffset   = UINT32_C(0xdeadbeef);
+        SERP_ARGS(node).writearg.beginoffset = UINT32_C(0xdeadbeef);
         if ( LIBIO_FLAGS_APPEND & iop->flags ) {
                 if ( updateAttr(node, 0) ) {
                         return -1;
                 }
-                SERP_ARGS(node).writearg.offset            = SERP_ATTR(node).size;
+                if (SERP_ATTR(node).size >= UINT32_MAX) {
+                        errno = EFBIG;
+                        return -1;
+                }
+                SERP_ARGS(node).writearg.offset = SERP_ATTR(node).size;
         } else {
-                SERP_ARGS(node).writearg.offset            = iop->offset;
-        }
+                if (iop->offset < 0) {
+                        errno = EINVAL;
+                        return -1;
+                }
+                if ((uintmax_t) iop->offset >= UINT32_MAX) {
+                        errno = EFBIG;
+                        return -1;
+                }
+                SERP_ARGS(node).writearg.offset = iop->offset;
+        }
+
+        if (count > UINT32_MAX - SERP_ARGS(node).writearg.offset) {
+                count = UINT32_MAX - SERP_ARGS(node).writearg.offset;
+        }
+
         SERP_ARGS(node).writearg.totalcount        = UINT32_C(0xdeadbeef);
         SERP_ARGS(node).writearg.data.data_len = count;
@@ -2818 +2850 @@
 sattr                                   arg;
 
+        if (length < 0) {
+                errno = EINVAL;
+                return -1;
+        }
+
+        if ((uintmax_t) length > UINT32_MAX) {
+                errno = EFBIG;
+                return -1;
+        }
+
         arg.size = length;
         /* must not modify any other attribute; if we are not the owner