mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 19:00:25 +00:00
cifs: integer overflow in parse_dacl()
On 32 bit systems num_aces * sizeof(struct cifs_ace *) could overflow leading to a smaller ppace buffer than we expected. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Jeff Layton <jlayton@samba.org> Signed-off-by: Steve French <smfrench@gmail.com>
This commit is contained in:
parent
a429638cac
commit
7250170c9e
1 changed files with 2 additions and 0 deletions
|
@ -909,6 +909,8 @@ static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
|
|||
umode_t group_mask = S_IRWXG;
|
||||
umode_t other_mask = S_IRWXU | S_IRWXG | S_IRWXO;
|
||||
|
||||
if (num_aces > ULONG_MAX / sizeof(struct cifs_ace *))
|
||||
return;
|
||||
ppace = kmalloc(num_aces * sizeof(struct cifs_ace *),
|
||||
GFP_KERNEL);
|
||||
if (!ppace) {
|
||||
|
|
Loading…
Reference in a new issue