Commit 17cf0c27 authored by Namjae Jeon's avatar Namjae Jeon Committed by Steve French
Browse files

ksmbd: validate request buffer size in smb2_allocate_rsp_buf() 



The response buffer should be allocated in smb2_allocate_rsp_buf
before validating request. But the fields in payload as well as smb2 header
is used in smb2_allocate_rsp_buf(). This patch add simple buffer size
validation to avoid potencial out-of-bounds in request buffer.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent c119f4ed

fs/smb/server/smb2pdu.c

+4 −0
Original line number Diff line number Diff line
@@ -535,6 +535,10 @@ int smb2_allocate_rsp_buf(struct ksmbd_work *work) 
	if (cmd == SMB2_QUERY_INFO_HE) {

		struct smb2_query_info_req *req;



		if (get_rfc1002_len(work->request_buf) <

		    offsetof(struct smb2_query_info_req, OutputBufferLength))

			return -EINVAL;



		req = smb2_get_msg(work->request_buf);

		if ((req->InfoType == SMB2_O_INFO_FILE &&

		     (req->FileInfoClass == FILE_FULL_EA_INFORMATION ||