mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-06 00:39:48 +00:00
CIFS: Fix a potencially linear read overflow
[ Upstream commitf980d055a0
] strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated. Also, the strnlen() call does not avoid the read overflow in the strlcpy function when a not NUL-terminated string is passed. So, replace this block by a call to kstrndup() that avoids this type of overflow and does the same. Fixes:066ce68994
("cifs: rename cifs_strlcpy_to_host and make it use new functions") Signed-off-by: Len Baker <len.baker@gmx.com> Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz> Reviewed-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
e37eeaf950
commit
b444064a0e
1 changed files with 2 additions and 7 deletions
|
@ -358,14 +358,9 @@ cifs_strndup_from_utf16(const char *src, const int maxlen,
|
||||||
if (!dst)
|
if (!dst)
|
||||||
return NULL;
|
return NULL;
|
||||||
cifs_from_utf16(dst, (__le16 *) src, len, maxlen, codepage,
|
cifs_from_utf16(dst, (__le16 *) src, len, maxlen, codepage,
|
||||||
NO_MAP_UNI_RSVD);
|
NO_MAP_UNI_RSVD);
|
||||||
} else {
|
} else {
|
||||||
len = strnlen(src, maxlen);
|
dst = kstrndup(src, maxlen, GFP_KERNEL);
|
||||||
len++;
|
|
||||||
dst = kmalloc(len, GFP_KERNEL);
|
|
||||||
if (!dst)
|
|
||||||
return NULL;
|
|
||||||
strlcpy(dst, src, len);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
return dst;
|
return dst;
|
||||||
|
|
Loading…
Reference in a new issue