kpriv/linux-hardened
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

cifs: read overflow in is_valid_oplock_break()

Browse source 
We need to verify that the "data_offset" is within bounds.

Reported-by: Dr Silvio Cesare of InfoSect <silvio.cesare@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
This commit is contained in:
Dan Carpenter 2018-09-06 12:47:01 +03:00 committed by Steve French
parent 2d204ee9d6
commit 097f5863b1
1 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
fs/cifs/misc.c
View file

@ -402,9 +402,17 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv)
(struct smb_com_transaction_change_notify_rsp *)buf; (struct smb_com_transaction_change_notify_rsp *)buf;
struct file_notify_information *pnotify; struct file_notify_information *pnotify;
__u32 data_offset = 0; __u32 data_offset = 0;
size_t len = srv->total_read - sizeof(pSMBr->hdr.smb_buf_length);
if (get_bcc(buf) > sizeof(struct file_notify_information)) { if (get_bcc(buf) > sizeof(struct file_notify_information)) {
data_offset = le32_to_cpu(pSMBr->DataOffset); data_offset = le32_to_cpu(pSMBr->DataOffset);
if (data_offset >
len - sizeof(struct file_notify_information)) {
cifs_dbg(FYI, "invalid data_offset %u\n",
data_offset);
return true;
}
pnotify = (struct file_notify_information *) pnotify = (struct file_notify_information *)
((char *)&pSMBr->hdr.Protocol + data_offset); ((char *)&pSMBr->hdr.Protocol + data_offset);
cifs_dbg(FYI, "dnotify on %s Action: 0x%x\n", cifs_dbg(FYI, "dnotify on %s Action: 0x%x\n",