X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=net%2Fsunrpc%2Fxdr.c;h=fde16f40a581dfb64e725e694afb4df5090693ed;hb=cf0b450cd5176b68ac7d5bbe68aeae6bb6a5a4b8;hp=8a4d9c106af1b37b1120a2adb53e21f7fb3dc317;hpb=b857c730d4e960d1876ff56ce5c4bd81ea9ff5ae;p=linux-2.6

diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 8a4d9c106a..fde16f40a5 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -993,6 +993,7 @@ xdr_xcode_array2(struct xdr_buf *buf, unsigned int base,
 			return -EINVAL;
 	} else {
 		if (xdr_decode_word(buf, base, &desc->array_len) != 0 ||
+		    desc->array_len > desc->array_maxlen ||
 		    (unsigned long) base + 4 + desc->array_len *
 				    desc->elem_size > buf->len)
 			return -EINVAL;