diff options
| author | Paulo Alcantara <pc@manguebit.com> | 2024-01-19 01:08:26 -0300 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2024-01-19 10:30:51 -0600 |
| commit | 76025cc2285d9ede3d717fe4305d66f8be2d9346 (patch) | |
| tree | d83bc931e81b3f69e56544fc7049344d73e9b901 | |
| parent | cfb7a13399be2234052a5bc480d166cd33047b0c (diff) | |
smb: client: fix parsing of SMB3.1.1 POSIX create context
The data offset for the SMB3.1.1 POSIX create context will always be
8-byte aligned so having the check 'noff + nlen >= doff' in
smb2_parse_contexts() is wrong as it will lead to -EINVAL because noff
+ nlen == doff.
Fix the sanity check to correctly handle aligned create context data.
Fixes: af1689a9b770 ("smb: client: fix potential OOBs in smb2_parse_contexts()")
Signed-off-by: Paulo Alcantara <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
| -rw-r--r-- | fs/smb/client/smb2pdu.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c index f8d70660ba29..ec39dfbc3154 100644 --- a/fs/smb/client/smb2pdu.c +++ b/fs/smb/client/smb2pdu.c @@ -2277,7 +2277,7 @@ int smb2_parse_contexts(struct TCP_Server_Info *server, noff = le16_to_cpu(cc->NameOffset); nlen = le16_to_cpu(cc->NameLength); - if (noff + nlen >= doff) + if (noff + nlen > doff) return -EINVAL; name = (char *)cc + noff; |