Merge pull request #437 from QRPp/fix-oob-nfs4_readlink_cb

Fix out-of-bounds reading of v4 READLINK results
sahlberg · Feb 24, 2024 · 73640ed · 73640ed
2 parents b7466b0 + 1918e4d
commit 73640ed
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/lib/nfs_v4.c b/lib/nfs_v4.c
@@ -2891,7 +2891,8 @@ nfs4_readlink_cb(struct rpc_context *rpc, int status, void *command_data,
 
         rlresok = &res->resarray.resarray_val[i].nfs_resop4_u.opreadlink.READLINK4res_u.resok4;
 
-        target = strdup(rlresok->link.utf8string_val);
+        target = strndup(rlresok->link.utf8string_val,
+                         rlresok->link.utf8string_len);
         if (target == NULL) {
                 data->cb(-ENOMEM, nfs, "Failed to allocate memory",
                          data->private_data);