Unverified Commit 1e531b83 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files
parents 877ccefa 1365d7de
Loading
Loading
Loading
Loading
+7 −1
Original line number Diff line number Diff line
@@ -478,7 +478,13 @@ static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt)
	if (xdr_stream_decode_u32(&rctxt->rc_stream, &segcount))
		return false;

	/* A bogus segcount causes this buffer overflow check to fail. */
	/* Before trusting the segcount value enough to use it in
	 * a computation, perform a simple range check. This is an
	 * arbitrary but sensible limit (ie, not architectural).
	 */
	if (unlikely(segcount > RPCSVC_MAXPAGES))
		return false;

	p = xdr_inline_decode(&rctxt->rc_stream,
			      segcount * rpcrdma_segment_maxsz * sizeof(*p));
	return p != NULL;