Commit 95d7a890 authored by Namjae Jeon's avatar Namjae Jeon Committed by Steve French
Browse files

ksmbd: fix buffer validation by including null terminator size in EA length 



The smb2_set_ea function, which handles Extended Attributes (EA),
was performing buffer validation checks that incorrectly omitted the size
of the null terminating character (+1 byte) for EA Name.
This patch fixes the issue by explicitly adding '+ 1' to EaNameLength where
the null terminator is expected to be present in the buffer, ensuring
the validation accurately reflects the total required buffer size.

Cc: stable@vger.kernel.org
Reported-by: default avatarRoger <roger.andersen@protonmail.com>
Reported-by: default avatarStanislas Polu <spolu@dust.tt>
Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent cafb57f7

fs/smb/server/smb2pdu.c

+2 −2
Original line number Diff line number Diff line
@@ -2363,7 +2363,7 @@ static int smb2_set_ea(struct smb2_ea_info *eabuf, unsigned int buf_len, 
	int rc = 0;

	unsigned int next = 0;



	if (buf_len < sizeof(struct smb2_ea_info) + eabuf->EaNameLength +

	if (buf_len < sizeof(struct smb2_ea_info) + eabuf->EaNameLength + 1 +

			le16_to_cpu(eabuf->EaValueLength))

		return -EINVAL;
@@ -2440,7 +2440,7 @@ static int smb2_set_ea(struct smb2_ea_info *eabuf, unsigned int buf_len, 
			break;

		}



		if (buf_len < sizeof(struct smb2_ea_info) + eabuf->EaNameLength +

		if (buf_len < sizeof(struct smb2_ea_info) + eabuf->EaNameLength + 1 +

				le16_to_cpu(eabuf->EaValueLength)) {

			rc = -EINVAL;

			break;