[NFS] Fix symlink length bound checking We were not taking into account the fact that the string length shares buffer space with the symlink text itself. Signed-off-by: Trond Myklebust --- nfs2xdr.c | 4 ++-- nfs3xdr.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) Index: linux-2.4.28-rc1/fs/nfs/nfs2xdr.c =================================================================== --- linux-2.4.28-rc1.orig/fs/nfs/nfs2xdr.c +++ linux-2.4.28-rc1/fs/nfs/nfs2xdr.c @@ -571,8 +571,8 @@ nfs_xdr_readlinkres(struct rpc_rqst *req strlen = (u32*)kmap(rcvbuf->pages[0]); /* Convert length of symlink */ len = ntohl(*strlen); - if (len > rcvbuf->page_len) - len = rcvbuf->page_len; + if (len > rcvbuf->page_len - sizeof(*strlen) - 1) + len = rcvbuf->page_len - sizeof(*strlen) - 1; *strlen = len; /* NULL terminate the string we got */ string = (char *)(strlen + 1); Index: linux-2.4.28-rc1/fs/nfs/nfs3xdr.c =================================================================== --- linux-2.4.28-rc1.orig/fs/nfs/nfs3xdr.c +++ linux-2.4.28-rc1/fs/nfs/nfs3xdr.c @@ -759,8 +759,8 @@ nfs3_xdr_readlinkres(struct rpc_rqst *re strlen = (u32*)kmap(rcvbuf->pages[0]); /* Convert length of symlink */ len = ntohl(*strlen); - if (len > rcvbuf->page_len) - len = rcvbuf->page_len; + if (len > rcvbuf->page_len - sizeof(*strlen) - 1) + len = rcvbuf->page_len - sizeof(*strlen) - 1; *strlen = len; /* NULL terminate the string we got */ string = (char *)(strlen + 1);