commit e837f13807a65abe29c0b8272b1d020c7f6391ff
author liucheng (G) <liucheng32@huawei.com> Thu Aug 29 13:47:48 2019 +0000
committer Joe Hershberger <joe.hershberger@ni.com> Wed Sep 04 11:37:19 2019 -0500
tree 25c1197dff0ca99de4c920efac3e92cf2e955245
parent 761b49f6b926104405f1c8f7d5ebd564c845e59d

CVE-2019-14194/CVE-2019-14198: nfs: fix unbounded memcpy with a failed length check at nfs_read_reply

This patch adds a check to rpc_pkt.u.reply.data at nfs_read_reply.

Signed-off-by: Cheng Liu <liucheng32@huawei.com>
Reported-by: Fermín Serna <fermin@semmle.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>

net/nfs.c

diff --git a/net/nfs.c b/net/nfs.c
index b7cf3b3..11941fa 100644
--- a/net/nfs.c
+++ b/net/nfs.c
@@ -701,6 +701,9 @@
 			&(rpc_pkt.u.reply.data[4 + nfsv3_data_offset]);
 	}
 
+	if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + rlen) > len)
+			return -9999;
+
 	if (store_block(data_ptr, nfs_offset, rlen))
 			return -9999;