diff options
| author | Steve French <sfrench@us.ibm.com> | 2005-11-09 14:33:22 -0800 |
|---|---|---|
| committer | Steve French <sfrench@us.ibm.com> | 2005-11-09 14:33:22 -0800 |
| commit | e82b3aec8d508d2a925a4c766e97f16b7c4dfb1b (patch) | |
| tree | 69d5685ef0c194f651a03e30bff14628b4d45400 /fs/nfsd/nfs3xdr.c | |
| parent | ec58ef03284f0bfa50a04982b74c8c2325a0758e (diff) | |
| parent | ad8f76be48d817b48222411ae16a7dfe257bdb24 (diff) | |
Merge with /pub/scm/linux/kernel/git/torvalds/linux-2.6.git
Diffstat (limited to 'fs/nfsd/nfs3xdr.c')
| -rw-r--r-- | fs/nfsd/nfs3xdr.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c index e0e134d6baba..9147b8524d05 100644 --- a/fs/nfsd/nfs3xdr.c +++ b/fs/nfsd/nfs3xdr.c @@ -366,7 +366,8 @@ nfs3svc_decode_writeargs(struct svc_rqst *rqstp, u32 *p, len = args->len = ntohl(*p++); hdr = (void*)p - rqstp->rq_arg.head[0].iov_base; - if (rqstp->rq_arg.len < len + hdr) + if (rqstp->rq_arg.len < hdr || + rqstp->rq_arg.len - hdr < len) return 0; args->vec[0].iov_base = (void*)p; |