kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-09 18:15:49 +00:00
Code Issues Releases Packages Activity
linux/fs/smb
History
Namjae Jeon 7a3bbbadac ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16() 
commit d10c77873b upstream.

If ->NameOffset/Length is bigger than ->CreateContextsOffset/Length,
ksmbd_check_message doesn't validate request buffer it correctly.
So slab-out-of-bounds warning from calling smb_strndup_from_utf16()
in smb2_open() could happen. If ->NameLength is non-zero, Set the larger
of the two sums (Name and CreateContext size) as the offset and length of
the data area.

Reported-by: Yang Chaoming <lometsj@live.com>
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2024-01-05 15:18:38 +01:00
..
client smb: client: fix OOB in smbCalcSize() 2024-01-01 12:39:05 +00:00
common ksmbd: send v2 lease break notification for directory 2024-01-05 15:18:36 +01:00
server ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16() 2024-01-05 15:18:38 +01:00
Kconfig smb: move client and server files to common directory fs/smb 2023-06-28 11:12:40 +02:00
Makefile smb: move client and server files to common directory fs/smb 2023-06-28 11:12:40 +02:00