Messages in this thread Patch in this message | | | Date | Thu, 23 Jul 2009 17:48:49 +0200 | From | Roel Kluin <> | Subject | [PATCH] smbfs: Read buffer overflow |
| |
This function uses signed integers for the unix_date and local variables - if a negative number is supplied and the leap-year condition is not met, month will be 0, leading to a read of day_n[-1]
Signed-off-by: Roel Kluin <roel.kluin@gmail.com> --- This is the easiest way to prevent the buffer overflow, but it produces a date. Maybe a magic date would be better? What should we choose?
Credits to Parfait and Nathan Keynes,
diff --git a/fs/smbfs/proc.c b/fs/smbfs/proc.c index 9468168..71c29b6 100644 --- a/fs/smbfs/proc.c +++ b/fs/smbfs/proc.c @@ -509,7 +509,7 @@ date_unix2dos(struct smb_sb_info *server, month = 2; } else { nl_day = (year & 3) || day <= 59 ? day : day - 1; - for (month = 0; month < 12; month++) + for (month = 1; month < 12; month++) if (day_n[month] > nl_day) break; }
| |