mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
092e0d0e96
orangefs_inode_getxattr() trusts the userspace-client-controlled downcall.resp.getxattr.val_sz and uses it as a memcpy() length both for the temporary user buffer and the cached xattr buffer. Reject malformed negative or oversized lengths before copying response bytes. Reported-by: Hyungjung Joo <jhj140711@gmail.com> Signed-off-by: HyungJung Joo <jhj140711@gmail.com> Signed-off-by: Mike Marshall <hubcap@omnibond.com>
566 lines
15 KiB
566 lines
15 KiB