From 537e6ef1541c5ea9ae2a04476707ee8f55557b45 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Fri, 7 Aug 2026 09:22:11 +0000 Subject: [PATCH] nfs: fix allocation check in LAYOUTGET fh_handles The check was too weak: it allowed fh_handles far beyond what fits in the remaining input, letting a crafted packet drive a large Vec::with_capacity preallocation in nom7 count(). Bound fh_handles by the remaining input size and by 4096, the maximum file layout stripe count used by the Linux kernel (NFS4_PNFS_MAX_STRIPE_CNT). Ticket: #8816. (cherry picked from commit f93d40bade2898f16ac7f15431d8e4360cdf574d) --- rust/src/nfs/nfs4_records.rs | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/rust/src/nfs/nfs4_records.rs b/rust/src/nfs/nfs4_records.rs index 89fe6b8a6e..d52efcfb36 100644 --- a/rust/src/nfs/nfs4_records.rs +++ b/rust/src/nfs/nfs4_records.rs @@ -929,9 +929,10 @@ fn nfs4_parse_res_layoutget(i: &[u8]) -> IResult<&[u8], Nfs4ResponseLayoutGet<'_ let (i, _strip_index) = be_u32(i)?; let (i, _offset) = be_u64(i)?; let (i, fh_handles) = be_u32(i)?; - // check before `count` allocates a vector - // so as not to run out of memory - if fh_handles as usize > 4 * i.len() { + // Each serialized handle is at least 4 bytes (be_u32 length prefix), + // so no more than i.len()/4 handles can be present. Also cap at the + // Linux kernel's NFS4_PNFS_MAX_STRIPE_CNT to bound count() preallocation. + if fh_handles as usize > i.len() / 4 || fh_handles > 4096 { return Err(Err::Error(make_error(i, ErrorKind::Count))); } let (i, file_handles) = count(nfs4_parse_handle, fh_handles as usize)(i)?;