Re: [patch] cifs: check offset in decode_ntlmssp_challenge()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



merged to cifs-2.6.git

On Tue, Jan 31, 2012 at 2:52 AM, Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
>
> We should check that we're not copying memory from beyond the end of the
> blob.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
>
> diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
> index d85efad..eb76741 100644
> --- a/fs/cifs/sess.c
> +++ b/fs/cifs/sess.c
> @@ -395,6 +395,10 @@ static int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
>        ses->ntlmssp->server_flags = le32_to_cpu(pblob->NegotiateFlags);
>        tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
>        tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
> +       if (tioffset > blob_len || tioffset + tilen > blob_len) {
> +               cERROR(1, "tioffset + tilen too high %u + %u", tioffset, tilen);
> +               return -EINVAL;
> +       }
>        if (tilen) {
>                ses->auth_key.response = kmalloc(tilen, GFP_KERNEL);
>                if (!ses->auth_key.response) {




--
Thanks,

Steve
--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Kernel Development]     [Kernel Announce]     [Kernel Newbies]     [Linux Networking Development]     [Share Photos]     [IDE]     [Security]     [Git]     [Netfilter]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Device Mapper]

  Powered by Linux