X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/5c9f46613a83ebfc29a5b1f099448259e96a98f0..a39ff7e25e19b3a8c3020042a3872ca9ec9659f1:/bsd/nfs/krpc_subr.c

diff --git a/bsd/nfs/krpc_subr.c b/bsd/nfs/krpc_subr.c
index 20fa08bd8..7ae7758e0 100644
--- a/bsd/nfs/krpc_subr.c
+++ b/bsd/nfs/krpc_subr.c
@@ -126,6 +126,7 @@ struct rpc_reply {
 };
 
 #define MIN_REPLY_HDR 16	/* xid, dir, astat, errno */
+#define REPLY_SIZE 24		/* xid, dir, astat, rpu_ok */
 
 /*
  * What is the longest we will wait before re-sending a request?
@@ -492,8 +493,16 @@ krpc_call(
 				goto out;
 			}
 
+
+			if (mbuf_len(m) < REPLY_SIZE) {
+				error = RPC_SYSTEM_ERR;
+			}
+			else {
+				error = ntohl(reply->rp_u.rpu_ok.rp_rstatus);
+			}
+
 			/* Did the call succeed? */
-			if ((error = ntohl(reply->rp_u.rpu_ok.rp_rstatus)) != 0) {
+			if (error != 0) {
 				printf("rpc status=%d\n", error);
 				/* convert rpc error to errno */
 				switch (error) {