#nfs

libnfs's NFSv4 GETATTR decoder bounds-checked every field read, then forgot to subtract two consumed strings from its remaining-length counter — so the checks passed while the read pointer walked off the reply buffer. A study in how present checks get defeated by absent bookkeeping.

libnfsnfsheap-overflowcwe-125parsing