1 files changed, 9 insertions, 0 deletions
diff --git a/src/kernel/vfs/request.c b/src/kernel/vfs/request.c
index 9c5b327..194ee49 100644
--- a/src/kernel/vfs/request.c
+++ b/src/kernel/vfs/request.c
@@ -174,6 +174,12 @@ vfsback_useraccept(VfsReq *req)
 			space -= len+1;
 		}
 		if (req->uin) {
+			if (space < req->uinlen && req->type == VFSOP_SETXATTR) {
+				/* don't truncate xattr values */
+				// TODO test
+				vfsreq_finish_short(req, -ERANGE);
+				return;
+			}
 			if (req->kin) {
 				/* save the address of the "second buffer" in id2,
 				 * which should be free */
@@ -181,6 +187,9 @@ vfsback_useraccept(VfsReq *req)
 				res.id2 = buf;
 			}
 
+			/* intentionally overriding the prior len */
+			assert(len == 0 || req->type == VFSOP_SETXATTR);
+
 			len = min(req->uinlen, space);
 			len = pcpy_bi(handler, buf, req->caller, req->uin, len);
 		}