From 64121b135066abca1808f49288c947e236922532 Mon Sep 17 00:00:00 2001
From: Konrad Sewiłło-Jopek <kjopek@gmail.com>
Date: Mon, 8 Aug 2022 12:25:48 -0400
Subject: 14899 lib9p: Remove potential buffer overwrite in l9p_puqids()
 Reviewed by: Jason King <jason.brian.king+illumos@gmail.com> Reviewed by:
 Andy Fiddaman <illumos@fiddaman.net> Approved by: Garrett D'Amore
 <garrett@damore.org>

---
 usr/src/lib/lib9p/common/pack.c | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

(limited to 'usr/src/lib/lib9p/common/pack.c')

diff --git a/usr/src/lib/lib9p/common/pack.c b/usr/src/lib/lib9p/common/pack.c
index 13ec5f02b5..eca17d0670 100644
--- a/usr/src/lib/lib9p/common/pack.c
+++ b/usr/src/lib/lib9p/common/pack.c
@@ -346,13 +346,17 @@ l9p_puqids(struct l9p_message *msg, uint16_t *num, struct l9p_qid *qids)
 	ssize_t ret, r;
 
 	r = l9p_pu16(msg, num);
-	if (r > 0) {
-		for (i = 0, lim = *num; i < lim; i++) {
-			ret = l9p_puqid(msg, &qids[i]);
-			if (ret < 0)
-				return (-1);
-			r += ret;
-		}
+	if (r <= 0)
+		return (r);
+
+	if (*num > L9P_MAX_WELEM)
+		return (-1);
+
+	for (i = 0, lim = *num; i < lim; i++) {
+		ret = l9p_puqid(msg, &qids[i]);
+		if (ret < 0)
+			return (-1);
+		r += ret;
 	}
 	return (r);
 }
-- 
cgit v1.2.3