[PATCH] NFS: Check lengths more thoroughly in NFS4 readdir XDR decode

[David Howells]

So, what you've done is:

-+		if (end - p < xlen)
++		if (end - p < xlen + 1)
  			goto short_pkt;
 +		dprintk("filename = %*s\n", len, (char *)p);
 +		p += xlen;
  		len = ntohl(*p++);	/* bitmap length */
 -		p += len;
 -		if (p + 1 > end)
-+		if (end - p < len)
++		if (end - p < len + 1)
  			goto short_pkt;
 +		p += len;
  		attrlen = XDR_QUADLEN(ntohl(*p++));
 -		p += attrlen;		/* attributes */
 -		if (p + 2 > end)
-+		if (end - p < attrlen + 1)
++		if (end - p < attrlen + 2)

But is this equivalent:

-+		if (end - p < xlen)
++		if (end - p <= xlen)
  			goto short_pkt;
 +		dprintk("filename = %*s\n", len, (char *)p);
 +		p += xlen;
  		len = ntohl(*p++);	/* bitmap length */
 -		p += len;
 -		if (p + 1 > end)
-+		if (end - p < len)
++		if (end - p <= len)
  			goto short_pkt;
 +		p += len;
  		attrlen = XDR_QUADLEN(ntohl(*p++));
 -		p += attrlen;		/* attributes */
 -		if (p + 2 > end)
-+		if (end - p < attrlen + 1)
++		if (end - p <= attrlen + 1)

Do you think?

David