[PATCH v1 02/17] xdrgen: Reject out-of-range short values on decode

[Chuck Lever <cel@kernel.org>]

RFC 4506 does not define a 16-bit integer type. xdrgen's "short"
follows rpcgen, whose runtime decodes the type in libtirpc's
xdr_short() by reading one XDR_UNIT as a long and assigning it to a
short with a plain cast. xdrgen_decode_short() mirrors that cast,
so an XDR_UNIT carrying a value outside the sign-extended 16-bit
range decodes as the low sixteen bits of that word. A decoder's
semantic checks on the narrowed value cannot see the discarded high
bits, the same defect xdrgen_decode_unsigned_short() had for the
unsigned type.

Nothing in XDR or rpcgen requires a decoder to accept such a word.
Fail the decode when the wire word, read as a signed 32-bit value,
lies outside S16_MIN to S16_MAX. xdrgen_encode_short() and
libtirpc's xdr_short() sign-extend an s16 to fill the XDR_UNIT, so
a conforming peer never sends such a word.

No NFS specification uses a signed short, so no generated decoder
calls xdrgen_decode_short() today. The check keeps the signed and
unsigned builtins consistent.

Signed-off-by: Chuck Lever <cel@kernel.org>
---
 include/linux/sunrpc/xdrgen/_builtins.h | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/include/linux/sunrpc/xdrgen/_builtins.h b/include/linux/sunrpc/xdrgen/_builtins.h
index 6b389181dc7b..55c514bae5d1 100644
--- a/include/linux/sunrpc/xdrgen/_builtins.h
+++ b/include/linux/sunrpc/xdrgen/_builtins.h
@@ -48,18 +48,20 @@ xdrgen_encode_bool(struct xdr_stream *xdr, bool val)
 
 /*
  * De facto (non-standard but commonly implemented) signed short type:
- *  - Wire sends sign-extended 32-bit value (e.g., 0xFFFFFFFF)
- *  - be32_to_cpup() returns u32 (0xFFFFFFFF)
- *  - Explicit (s16) cast truncates to 16 bits (0xFFFF = -1)
+ * 16-bit integer sign-extended to fill one XDR_UNIT.
  */
 static inline bool
 xdrgen_decode_short(struct xdr_stream *xdr, s16 *ptr)
 {
 	__be32 *p = xdr_inline_decode(xdr, XDR_UNIT);
+	s32 val;
 
 	if (unlikely(!p))
 		return false;
-	*ptr = (s16)be32_to_cpup(p);
+	val = be32_to_cpup(p);
+	if (unlikely(val < S16_MIN || val > S16_MAX))
+		return false;
+	*ptr = val;
 	return true;
 }
 
-- 
2.56.0