smb: client: fix parsing of SMB3.1.1 POSIX create context
[ Upstream commit 76025cc2285d9ede3d717fe4305d66f8be2d9346 ] The data offset for the SMB3.1.1 POSIX create context will always be 8-byte aligned so having the check 'noff + nlen >= doff' in smb2_parse_contexts() is wrong as it will lead to -EINVAL because noff + nlen == doff. Fix the sanity check to correctly handle aligned create context data. Fixes: af1689a9b770 ("smb: client: fix potential OOBs in smb2_parse_contexts()") Signed-off-by: Paulo Alcantara <pc@manguebit.com> Signed-off-by: Steve French <stfrench@microsoft.com> [Guru:smb2_parse_contexts() is present in file smb2ops.c, smb2ops.c file location is changed, modified patch accordingly.] Signed-off-by: Guruswamy Basavaiah <guruswamy.basavaiah@broadcom.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Родитель
890bc4fac3
Коммит
ee0fb9baa7
|
@ -2094,7 +2094,7 @@ int smb2_parse_contexts(struct TCP_Server_Info *server,
|
|||
|
||||
noff = le16_to_cpu(cc->NameOffset);
|
||||
nlen = le16_to_cpu(cc->NameLength);
|
||||
if (noff + nlen >= doff)
|
||||
if (noff + nlen > doff)
|
||||
return -EINVAL;
|
||||
|
||||
name = (char *)cc + noff;
|
||||
|
|
Загрузка…
Ссылка в новой задаче