mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-04 01:49:36 +00:00
cifs: prevent integer overflow in nxt_dir_entry()
The "old_entry + le32_to_cpu(pDirInfo->NextEntryOffset)" can wrap around so I have added a check for integer overflow. Reported-by: Dr Silvio Cesare of InfoSect <silvio.cesare@gmail.com> Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com> Reviewed-by: Aurelien Aptel <aaptel@suse.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Steve French <stfrench@microsoft.com> CC: Stable <stable@vger.kernel.org>
This commit is contained in:
parent
5890184d2b
commit
8ad8aa3535
1 changed files with 9 additions and 2 deletions
|
@ -376,8 +376,15 @@ static char *nxt_dir_entry(char *old_entry, char *end_of_smb, int level)
|
|||
|
||||
new_entry = old_entry + sizeof(FIND_FILE_STANDARD_INFO) +
|
||||
pfData->FileNameLength;
|
||||
} else
|
||||
new_entry = old_entry + le32_to_cpu(pDirInfo->NextEntryOffset);
|
||||
} else {
|
||||
u32 next_offset = le32_to_cpu(pDirInfo->NextEntryOffset);
|
||||
|
||||
if (old_entry + next_offset < old_entry) {
|
||||
cifs_dbg(VFS, "invalid offset %u\n", next_offset);
|
||||
return NULL;
|
||||
}
|
||||
new_entry = old_entry + next_offset;
|
||||
}
|
||||
cifs_dbg(FYI, "new entry %p old entry %p\n", new_entry, old_entry);
|
||||
/* validate that new_entry is not past end of SMB */
|
||||
if (new_entry >= end_of_smb) {
|
||||
|
|
Loading…
Reference in a new issue