lkml.org 
[lkml]   [2007]   [Dec]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: LINUX kernel 2.6.23: bug in CIFSSMBSetEA
    > In fs/cifs/cifssmb.c, in CIFSSMBSetEA (...) function wrong counting of
    > var exists.

    >
    > EXISTING CODE:
    > pSMB->DataCount = sizeof(*parm_data) + ea_value_len + name_len + 1;
    >
    > MUST BE:
    > pSMB->DataCount = sizeof(*parm_data) + ea_value_len + name_len;
    >

    > REASON:
    > "sizeof(*parm_data)" counts 1 byte from "char name[1];"
    >
    > So, for example in Samba server (sources/smbd/trans2.c), we can see

    > wrong processing of EA, cause data sent to server is bigger on 1 byte
    > then it must be.
    >
    > See Extra info for details
    >
    > --------------------------------------------- Extra info

    >
    > struct fealist *parm_data;
    >
    > 1707 struct fea {
    > 1708 unsigned char EA_flags;
    > 1709 __u8 name_len;
    > 1710 __u16 value_len;
    > 1711 char name
    [1];
    > 1712 /* optionally followed by value */
    > 1713 };
    > 1714 /* flags for _FEA.fEA */
    > 1715 #define FEA_NEEDEA 0x80 /* need EA bit */

    > 1716
    > 1717 struct fealist {
    > 1718 __u32 list_len;
    > 1719 struct fea list[1];
    > 1720 };



    Yes - you are correct (note that Windows is less strict with the extra
    pad byte than current Samba, and I don't remember seeing this with
    older Samba server versions perhaps the length check ).


    I have checked in a fix to the cifs development tree. Thanks.



    --
    Thanks,

    Steve


    \
     
     \ /
      Last update: 2007-12-31 01:27    [W:0.021 / U:1.420 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site