mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-02 23:27:06 +00:00
ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea()
commit 79ed288cef
upstream.
There are multiple smb2_ea_info buffers in FILE_FULL_EA_INFORMATION request
from client. ksmbd find next smb2_ea_info using ->NextEntryOffset of
current smb2_ea_info. ksmbd need to validate buffer length Before
accessing the next ea. ksmbd should check buffer length using buf_len,
not next variable. next is the start offset of current ea that got from
previous ea.
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21598
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
ff7236b66d
commit
4bf629262f
1 changed files with 8 additions and 1 deletions
|
@ -2324,9 +2324,16 @@ static int smb2_set_ea(struct smb2_ea_info *eabuf, unsigned int buf_len,
|
|||
break;
|
||||
buf_len -= next;
|
||||
eabuf = (struct smb2_ea_info *)((char *)eabuf + next);
|
||||
if (next < (u32)eabuf->EaNameLength + le16_to_cpu(eabuf->EaValueLength))
|
||||
if (buf_len < sizeof(struct smb2_ea_info)) {
|
||||
rc = -EINVAL;
|
||||
break;
|
||||
}
|
||||
|
||||
if (buf_len < sizeof(struct smb2_ea_info) + eabuf->EaNameLength +
|
||||
le16_to_cpu(eabuf->EaValueLength)) {
|
||||
rc = -EINVAL;
|
||||
break;
|
||||
}
|
||||
} while (next != 0);
|
||||
|
||||
kfree(attr_name);
|
||||
|
|
Loading…
Reference in a new issue