[src/trunk]: src/sys/nfs nfs: Use unsigned fhlen so we don't trip over negati...

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/cfb6c5f58375
branches:  trunk
changeset: 374001:cfb6c5f58375
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Thu Mar 23 19:52:33 2023 +0000

description:
nfs: Use unsigned fhlen so we don't trip over negative values.

XXX pullup-8
XXX pullup-9
XXX pullup-10

diffstat:

 sys/nfs/nfsm_subs.h |  12 ++++++++----
 1 files changed, 8 insertions(+), 4 deletions(-)

diffs (37 lines):

diff -r 30cd27557d74 -r cfb6c5f58375 sys/nfs/nfsm_subs.h
--- a/sys/nfs/nfsm_subs.h       Thu Mar 23 18:22:15 2023 +0000
+++ b/sys/nfs/nfsm_subs.h       Thu Mar 23 19:52:33 2023 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: nfsm_subs.h,v 1.55 2021/08/12 20:25:27 andvar Exp $    */
+/*     $NetBSD: nfsm_subs.h,v 1.56 2023/03/23 19:52:33 riastradh Exp $ */
 
 /*
  * Copyright (c) 1989, 1993
@@ -480,20 +480,24 @@
                } }
 
 #define nfsm_srvmtofh(nsfh) \
-       { int fhlen = NFSX_V3FH; \
+       { uint32_t fhlen = NFSX_V3FH; \
                if (nfsd->nd_flag & ND_NFSV3) { \
-                       nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED); \
-                       fhlen = fxdr_unsigned(int, *tl); \
+                       nfsm_dissect(tl, uint32_t *, NFSX_UNSIGNED); \
+                       fhlen = fxdr_unsigned(uint32_t, *tl); \
+                       CTASSERT(NFSX_V3FHMAX <= FHANDLE_SIZE_MAX); \
                        if (fhlen > NFSX_V3FHMAX || \
                            (fhlen < FHANDLE_SIZE_MIN && fhlen > 0)) { \
                                error = EBADRPC; \
                                nfsm_reply(0); \
                        } \
                } else { \
+                       CTASSERT(NFSX_V2FH >= FHANDLE_SIZE_MIN); \
                        fhlen = NFSX_V2FH; \
                } \
                (nsfh)->nsfh_size = fhlen; \
                if (fhlen != 0) { \
+                       KASSERT(fhlen >= FHANDLE_SIZE_MIN); \
+                       KASSERT(fhlen <= FHANDLE_SIZE_MAX); \
                        nfsm_dissect(tl, u_int32_t *, fhlen); \
                        memcpy(NFSRVFH_DATA(nsfh), tl, fhlen); \
                } \