korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-24 12:44:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea()

Browse Source 
There are multiple smb2_ea_info buffers in FILE_FULL_EA_INFORMATION request
from client. ksmbd find next smb2_ea_info using ->NextEntryOffset of
current smb2_ea_info. ksmbd need to validate buffer length Before
accessing the next ea. ksmbd should check buffer length using buf_len,
not next variable. next is the start offset of current ea that got from
previous ea.

Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21598
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
This commit is contained in:
Namjae Jeon 2023-08-06 08:44:17 +09:00 committed by Steve French
parent 5aa4fda5aa
commit 79ed288cef
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
fs/smb/server/smb2pdu.c
View File

@ -2324,9 +2324,16 @@ next:
break; break;
buf_len -= next; buf_len -= next;
eabuf = (struct smb2_ea_info *)((char *)eabuf + next); eabuf = (struct smb2_ea_info *)((char *)eabuf + next);
if (next < (u32)eabuf->EaNameLength + le16_to_cpu(eabuf->EaValueLength)) if (buf_len < sizeof(struct smb2_ea_info)) {
rc = -EINVAL;
break; break;
}
if (buf_len < sizeof(struct smb2_ea_info) + eabuf->EaNameLength +
le16_to_cpu(eabuf->EaValueLength)) {
rc = -EINVAL;
break;
}
} while (next != 0); } while (next != 0);
kfree(attr_name); kfree(attr_name);