diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-01-31 11:52:01 +0300 |
|---|---|---|
| committer | Steve French <smfrench@gmail.com> | 2012-01-31 07:42:06 -0600 |
| commit | 4991a5faab7368daac463181e786608b4eb63675 (patch) | |
| tree | de09a9fbbfae716c5dc2cb57a1f83a0460a8c8f4 | |
| parent | 803ab977618eae2b292cda0a97eed75f42250ddf (diff) | |
| download | drm-intel-4991a5faab7368daac463181e786608b4eb63675.tar.gz | |
cifs: check offset in decode_ntlmssp_challenge()
We should check that we're not copying memory from beyond the end of the
blob.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
| -rw-r--r-- | fs/cifs/sess.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c index d85efad5765f67..eb767412177dae 100644 --- a/fs/cifs/sess.c +++ b/fs/cifs/sess.c @@ -395,6 +395,10 @@ static int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len, ses->ntlmssp->server_flags = le32_to_cpu(pblob->NegotiateFlags); tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset); tilen = le16_to_cpu(pblob->TargetInfoArray.Length); + if (tioffset > blob_len || tioffset + tilen > blob_len) { + cERROR(1, "tioffset + tilen too high %u + %u", tioffset, tilen); + return -EINVAL; + } if (tilen) { ses->auth_key.response = kmalloc(tilen, GFP_KERNEL); if (!ses->auth_key.response) { |