From 59f862c45447944f00426375e97bcd2f73c6f99e Mon Sep 17 00:00:00 2001 From: cao-bing-6 Date: Wed, 22 Jun 2022 03:13:18 +0000 Subject: [PATCH] uboot Fix CVE-2022-30767 Signed-off-by: cao-bing-6 Change-Id: I7d7c1bb2286c6e72be96ced7fc218ef5db248bd6 --- u-boot-2020.01/net/nfs.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/u-boot-2020.01/net/nfs.c b/u-boot-2020.01/net/nfs.c index 97e62f1dce..d119f16ba8 100644 --- a/u-boot-2020.01/net/nfs.c +++ b/u-boot-2020.01/net/nfs.c @@ -54,7 +54,7 @@ static ulong nfs_timeout = NFS_TIMEOUT; static char dirfh[NFS_FHSIZE]; /* NFSv2 / NFSv3 file handle of directory */ static char filefh[NFS3_FHSIZE]; /* NFSv2 / NFSv3 file handle */ -static int filefh3_length; /* (variable) length of filefh when NFSv3 */ +static unsigned int filefh3_length; /* (variable) length of filefh when NFSv3 */ static enum net_loop_state nfs_download_state; static struct in_addr nfs_server_ip; @@ -574,8 +574,6 @@ static int nfs_lookup_reply(uchar *pkt, unsigned len) filefh3_length = ntohl(rpc_pkt.u.reply.data[1]); if (filefh3_length > NFS3_FHSIZE) filefh3_length = NFS3_FHSIZE; - if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + filefh3_length) > len) - return -NFS_RPC_DROP; memcpy(filefh, rpc_pkt.u.reply.data + 2, filefh3_length); } -- Gitee