lkml.org 
[lkml]   [2013]   [Jul]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[038/141] cifs: fix potential buffer overrun when composing a new options string
    3.6.11.6 stable review patch.
    If anyone has any objections, please let me know.

    ------------------

    From: Jeff Layton <jlayton@redhat.com>

    [ Upstream commit 166faf21bd14bc5c5295a44874bf7f3930c30b20 ]

    Consider the case where we have a very short ip= string in the original
    mount options, and when we chase a referral we end up with a very long
    IPv6 address. Be sure to allow for that possibility when estimating the
    size of the string to allocate.

    Cc: <stable@vger.kernel.org>
    Signed-off-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Steve French <sfrench@us.ibm.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    ---
    fs/cifs/cifs_dfs_ref.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
    index ce5cbd7..52527dd 100644
    --- a/fs/cifs/cifs_dfs_ref.c
    +++ b/fs/cifs/cifs_dfs_ref.c
    @@ -18,6 +18,7 @@
    #include <linux/slab.h>
    #include <linux/vfs.h>
    #include <linux/fs.h>
    +#include <linux/inet.h>
    #include "cifsglob.h"
    #include "cifsproto.h"
    #include "cifsfs.h"
    @@ -150,7 +151,8 @@ char *cifs_compose_mount_options(const char *sb_mountdata,
    * assuming that we have 'unc=' and 'ip=' in
    * the original sb_mountdata
    */
    - md_len = strlen(sb_mountdata) + rc + strlen(ref->node_name) + 12;
    + md_len = strlen(sb_mountdata) + rc + strlen(ref->node_name) + 12 +
    + INET6_ADDRSTRLEN;
    mountdata = kzalloc(md_len+1, GFP_KERNEL);
    if (mountdata == NULL) {
    rc = -ENOMEM;
    --
    1.7.10.4



    \
     
     \ /
      Last update: 2013-07-04 01:01    [W:2.600 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site