1From aa207cf3a6d68f39d64cd29057a4fb63943e9078 Mon Sep 17 00:00:00 2001 2From: "liucheng (G)" <liucheng32@huawei.com> 3Date: Thu, 29 Aug 2019 13:47:48 +0000 4Subject: [PATCH] CVE-2019-14194/CVE-2019-14198: nfs: fix unbounded memcpy with 5 a failed length check at nfs_read_reply 6MIME-Version: 1.0 7Content-Type: text/plain; charset=utf8 8Content-Transfer-Encoding: 8bit 9 10This patch adds a check to rpc_pkt.u.reply.data at nfs_read_reply. 11 12Signed-off-by: Cheng Liu <liucheng32@huawei.com> 13Reported-by: FermÃn Serna <fermin@semmle.com> 14Acked-by: Joe Hershberger <joe.hershberger@ni.com> 15--- 16 net/nfs.c | 3 +++ 17 1 file changed, 3 insertions(+) 18 19diff --git a/net/nfs.c b/net/nfs.c 20index b7cf3b3..11941fa 100644 21--- a/net/nfs.c 22+++ b/net/nfs.c 23@@ -701,6 +701,9 @@ static int nfs_read_reply(uchar *pkt, unsigned len) 24 &(rpc_pkt.u.reply.data[4 + nfsv3_data_offset]); 25 } 26 27+ if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + rlen) > len) 28+ return -9999; 29+ 30 if (store_block(data_ptr, nfs_offset, rlen)) 31 return -9999; 32 33-- 341.9.1 35 36