nfs: Fix out of bounds read
nfs_read_reply() interprets the fields of an incoming packet directly as a field length without checking the boundaries. Clamp the maximum length to the packet length to avoid reading out of bounds. Reported-by: Jai Verma <jai2.verma@outlook.com> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> |
---|
|
net/nfs.c |
---|