NFSv3: Fix an XDR overflow bug in READDIRPLUS

fs/nfs/nfs3xdr.c

@@ -536,16 +536,16 @@ nfs3_xdr_readdirres(struct rpc_rqst *req, u32 *p, struct nfs3_readdirres *res)
 
 		if (res->plus) {
 			/* post_op_attr */
-			if (p > end)
+			if (p + 2 > end)
 				goto short_pkt;
 			if (*p++) {
 				p += 21;
-				if (p > end)
+				if (p + 1 > end)
 					goto short_pkt;
 			}
 			/* post_op_fh3 */
 			if (*p++) {
-				if (p > end)
+				if (p + 1 > end)
 					goto short_pkt;
 				len = ntohl(*p++);
 				if (len > NFS3_FHSIZE) {