#libnfs
2 writeups.
-
Client-side memory-safety bugs in libnfs and libsmb2 went nowhere for two weeks, then got fixed within hours of one follow-up — and the parts worth remembering are the disclosure mechanics and the two moments verification saved the report.
-
libnfs's NFSv4 GETATTR decoder bounds-checked every field read, then forgot to subtract two consumed strings from its remaining-length counter — so the checks passed while the read pointer walked off the reply buffer. A study in how present checks get defeated by absent bookkeeping.