$NetBSD: patch-bh,v 1.1 2008/06/07 23:58:11 tonnerre Exp $

--- lib/rpc/svc_auth_gss.c.orig	2004-09-17 23:52:11.000000000 +0200
+++ lib/rpc/svc_auth_gss.c
@@ -355,6 +355,15 @@ svcauth_gss_validate(struct svc_req *rqs
 	memset(rpchdr, 0, sizeof(rpchdr));
 
 	/* XXX - Reconstruct RPC header for signing (from xdr_callmsg). */
+	oa = &msg->rm_call.cb_cred;
+	if (oa->oa_length > MAX_AUTH_BYTES)
+		return (FALSE);
+
+	/* 8 XDR units from the IXDR macro calls. */
+	if (sizeof(rpchdr) < (8 * BYTES_PER_XDR_UNIT +
+			      RNDUP(oa->oa_length)))
+		return (FALSE);
+
 	buf = (int32_t *)(void *)rpchdr;
 	IXDR_PUT_LONG(buf, msg->rm_xid);
 	IXDR_PUT_ENUM(buf, msg->rm_direction);
@@ -362,7 +371,6 @@ svcauth_gss_validate(struct svc_req *rqs
 	IXDR_PUT_LONG(buf, msg->rm_call.cb_prog);
 	IXDR_PUT_LONG(buf, msg->rm_call.cb_vers);
 	IXDR_PUT_LONG(buf, msg->rm_call.cb_proc);
-	oa = &msg->rm_call.cb_cred;
 	IXDR_PUT_ENUM(buf, oa->oa_flavor);
 	IXDR_PUT_LONG(buf, oa->oa_length);
 	if (oa->oa_length) {
