Commit 70bccd98 authored by Makar Semyonov's avatar Makar Semyonov Committed by Steve French
Browse files

cifs: prevent NULL pointer dereference in UTF16 conversion 



There can be a NULL pointer dereference bug here. NULL is passed to
__cifs_sfu_make_node without checks, which passes it unchecked to
cifs_strndup_to_utf16, which in turn passes it to
cifs_local_to_utf16_bytes where '*from' is dereferenced, causing a crash.

This patch adds a check for NULL 'src' in cifs_strndup_to_utf16 and
returns NULL early to prevent dereferencing NULL pointer.

Found by Linux Verification Center (linuxtesting.org) with SVACE

Signed-off-by: default avatarMakar Semyonov <m.semenov@tssltd.ru>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 91be128b

fs/smb/client/cifs_unicode.c

+3 −0
Original line number Diff line number Diff line
@@ -629,6 +629,9 @@ cifs_strndup_to_utf16(const char *src, const int maxlen, int *utf16_len, 
	int len;

	__le16 *dst;



	if (!src)

		return NULL;



	len = cifs_local_to_utf16_bytes(src, maxlen, cp);

	len += 2; /* NULL */

	dst = kmalloc(len, GFP_KERNEL);