[prev in list] [next in list] [prev in thread] [next in thread]
List: samba-technical
Subject: Re: [patch] cifs: check offset in decode_ntlmssp_challenge()
From: Steve French <smfrench () gmail ! com>
Date: 2012-01-31 13:43:10
Message-ID: CAH2r5ms5mt9=pzOhKKpJ16wqnu_A-aRy2oJm4HVCrwUH1aBfvA () mail ! gmail ! com
[Download RAW message or body]
merged to cifs-2.6.git
On Tue, Jan 31, 2012 at 2:52 AM, Dan Carpenter <dan.carpenter@oracle.com> wrote:
>
> We should check that we're not copying memory from beyond the end of the
> blob.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
> index d85efad..eb76741 100644
> --- a/fs/cifs/sess.c
> +++ b/fs/cifs/sess.c
> @@ -395,6 +395,10 @@ static int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
> ses->ntlmssp->server_flags = le32_to_cpu(pblob->NegotiateFlags);
> tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
> tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
> + if (tioffset > blob_len || tioffset + tilen > blob_len) {
> + cERROR(1, "tioffset + tilen too high %u + %u", tioffset, tilen);
> + return -EINVAL;
> + }
> if (tilen) {
> ses->auth_key.response = kmalloc(tilen, GFP_KERNEL);
> if (!ses->auth_key.response) {
--
Thanks,
Steve
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic