diff options
| author | David Woodhouse <dwmw2@shinybook.infradead.org> | 2005-08-17 14:37:55 +0100 |
|---|---|---|
| committer | David Woodhouse <dwmw2@shinybook.infradead.org> | 2005-08-17 14:37:55 +0100 |
| commit | 327b6b08d6ab3bf5488120ba02ed2fe06b09efe6 (patch) | |
| tree | 592b0ebc2f5f18dac0bdc0fd6ba87d2c8b07b232 /net/sunrpc/xdr.c | |
| parent | c973b112c76c9d8fd042991128f218a738cc8d0a (diff) | |
| parent | 2ad56496627630ebc99f06af5f81ca23e17e014e (diff) | |
Merge with master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6.git
Diffstat (limited to 'net/sunrpc/xdr.c')
| -rw-r--r-- | net/sunrpc/xdr.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c index 8a4d9c106af..fde16f40a58 100644 --- a/net/sunrpc/xdr.c +++ b/net/sunrpc/xdr.c @@ -993,6 +993,7 @@ xdr_xcode_array2(struct xdr_buf *buf, unsigned int base, return -EINVAL; } else { if (xdr_decode_word(buf, base, &desc->array_len) != 0 || + desc->array_len > desc->array_maxlen || (unsigned long) base + 4 + desc->array_len * desc->elem_size > buf->len) return -EINVAL; |