PATCH: sunrpc/PR 1549

[Thorsten Kukuk <kukuk at suse dot de>]

Hi,

I have append a patch for PR/1549, so we can close this bug.

  Thorsten
-- 
Thorsten Kukuk       http://www.suse.de/~kukuk/       kukuk@suse.de
SuSE GmbH            Schanzaeckerstr. 10            90443 Nuernberg
Linux is like a Vorlon.  It is incredibly powerful, gives terse,
cryptic answers and has a lot of things going on in the background.
2000-06-23  Thorsten Kukuk  <kukuk@suse.de>

	* xdr_rec.c (set_input_fragment) Fix Bug libc/1549, patch from
	  Jens Moeller <jens.moeller@waii.com>

--- sunrpc/xdr_rec.c
+++ sunrpc/xdr_rec.c	2000/06/23 07:10:38
@@ -605,14 +605,16 @@
   header = ntohl (header);
   rstrm->last_frag = ((header & LAST_FRAG) == 0) ? FALSE : TRUE;
   /*
-   * Sanity check. Try not to accept wildly incorrect
-   * record sizes. Unfortunately, the only record size
-   * we can positively identify as being 'wildly incorrect'
-   * is zero.  Ridiculously large record sizes may look wrong,
-   * but we don't have any way to be certain that they aren't
-   * what the client actually intended to send us.
+   * Sanity check. Try not to accept wildly incorrect fragment
+   * sizes. Unfortunately, only a size of zero can be identified as
+   * 'wildely incorrect', and this only, if it is not the last
+   * fragment of a message. Ridiculously large fragment sizes may look
+   * wrong, but we don't have any way to be certain that they aren't
+   * what the client actually intended to send us. Many existing RPC
+   * implementations may sent a fragment of size zero as the last
+   * fragment of a message.
    */
-  if ((header & (~LAST_FRAG)) == 0)
+  if (header == 0)
     return FALSE;
   rstrm->fbtbc = header & ~LAST_FRAG;
   return TRUE;