diff options
Diffstat (limited to 'fs/nfs/nfs4xdr.c')
-rw-r--r-- | fs/nfs/nfs4xdr.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c index dddfb5795d7b..ba952bdc4d62 100644 --- a/fs/nfs/nfs4xdr.c +++ b/fs/nfs/nfs4xdr.c | |||
@@ -4838,17 +4838,19 @@ static int decode_secinfo(struct xdr_stream *xdr, struct nfs4_secinfo_res *res) | |||
4838 | struct nfs4_secinfo_flavor *sec_flavor; | 4838 | struct nfs4_secinfo_flavor *sec_flavor; |
4839 | int status; | 4839 | int status; |
4840 | __be32 *p; | 4840 | __be32 *p; |
4841 | int i; | 4841 | int i, num_flavors; |
4842 | 4842 | ||
4843 | status = decode_op_hdr(xdr, OP_SECINFO); | 4843 | status = decode_op_hdr(xdr, OP_SECINFO); |
4844 | p = xdr_inline_decode(xdr, 4); | 4844 | p = xdr_inline_decode(xdr, 4); |
4845 | if (unlikely(!p)) | 4845 | if (unlikely(!p)) |
4846 | goto out_overflow; | 4846 | goto out_overflow; |
4847 | res->flavors->num_flavors = be32_to_cpup(p); | ||
4848 | 4847 | ||
4849 | for (i = 0; i < res->flavors->num_flavors; i++) { | 4848 | res->flavors->num_flavors = 0; |
4849 | num_flavors = be32_to_cpup(p); | ||
4850 | |||
4851 | for (i = 0; i < num_flavors; i++) { | ||
4850 | sec_flavor = &res->flavors->flavors[i]; | 4852 | sec_flavor = &res->flavors->flavors[i]; |
4851 | if ((char *)&sec_flavor[1] - (char *)res > PAGE_SIZE) | 4853 | if ((char *)&sec_flavor[1] - (char *)res->flavors > PAGE_SIZE) |
4852 | break; | 4854 | break; |
4853 | 4855 | ||
4854 | p = xdr_inline_decode(xdr, 4); | 4856 | p = xdr_inline_decode(xdr, 4); |
@@ -4860,6 +4862,7 @@ static int decode_secinfo(struct xdr_stream *xdr, struct nfs4_secinfo_res *res) | |||
4860 | if (decode_secinfo_gss(xdr, sec_flavor)) | 4862 | if (decode_secinfo_gss(xdr, sec_flavor)) |
4861 | break; | 4863 | break; |
4862 | } | 4864 | } |
4865 | res->flavors->num_flavors++; | ||
4863 | } | 4866 | } |
4864 | 4867 | ||
4865 | return 0; | 4868 | return 0; |