diff options
| author | Jeff Layton <jlayton@redhat.com> | 2008-12-17 06:31:53 -0500 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2008-12-17 14:59:55 -0800 |
| commit | 331c31351044888916805c9cb32d8bb9e40c12e9 (patch) | |
| tree | 41b7d9c95c1e5e1f413c3b026a26979c34d0b3e0 | |
| parent | a52519f2ce180890069fa7b1a92fa51d4448a0ba (diff) | |
| download | linux-stable-331c31351044888916805c9cb32d8bb9e40c12e9.tar.gz linux-stable-331c31351044888916805c9cb32d8bb9e40c12e9.tar.bz2 linux-stable-331c31351044888916805c9cb32d8bb9e40c12e9.zip | |
cifs: fix buffer overrun in parse_DFS_referrals
While testing a kernel with memory poisoning enabled, I saw some warnings
about the redzone getting clobbered when chasing DFS referrals. The
buffer allocation for the unicode converted version of the searchName is
too small and needs to take null termination into account.
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Acked-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| -rw-r--r-- | fs/cifs/cifssmb.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c index 2af8626ced43..6d51696dc762 100644 --- a/fs/cifs/cifssmb.c +++ b/fs/cifs/cifssmb.c @@ -3983,7 +3983,8 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr, node->flags = le16_to_cpu(pSMBr->DFSFlags); if (is_unicode) { - __le16 *tmp = kmalloc(strlen(searchName)*2, GFP_KERNEL); + __le16 *tmp = kmalloc(strlen(searchName)*2 + 2, + GFP_KERNEL); cifsConvertToUCS((__le16 *) tmp, searchName, PATH_MAX, nls_codepage, remap); node->path_consumed = hostlen_fromUCS(tmp, |