lkml.org 
[lkml]   [2011]   [May]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[01/71] cifs: change bleft in decode_unicode_ssetup back to signed type
    2.6.38-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Jeff Layton <jlayton@redhat.com>

    commit bfacf2225a955bea9c41c707fc72ba16009674a0 upstream.

    The buffer length checks in this function depend on this value being a
    signed data type, but 690c522fa converted it to an unsigned type.

    Also, eliminate a problem with the null termination check in the same
    function. cifs_strndup_from_ucs handles that situation correctly
    already, and the existing check could potentially lead to a buffer
    overrun since it increments bleft without checking to see whether it
    falls off the end of the buffer.

    Reported-and-Acked-by: David Howells <dhowells@redhat.com>
    Signed-off-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Steve French <sfrench@us.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    fs/cifs/sess.c | 15 +--------------
    1 file changed, 1 insertion(+), 14 deletions(-)

    --- a/fs/cifs/sess.c
    +++ b/fs/cifs/sess.c
    @@ -277,7 +277,7 @@ static void ascii_ssetup_strings(char **
    }

    static void
    -decode_unicode_ssetup(char **pbcc_area, __u16 bleft, struct cifsSesInfo *ses,
    +decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifsSesInfo *ses,
    const struct nls_table *nls_cp)
    {
    int len;
    @@ -285,19 +285,6 @@ decode_unicode_ssetup(char **pbcc_area,

    cFYI(1, "bleft %d", bleft);

    - /*
    - * Windows servers do not always double null terminate their final
    - * Unicode string. Check to see if there are an uneven number of bytes
    - * left. If so, then add an extra NULL pad byte to the end of the
    - * response.
    - *
    - * See section 2.7.2 in "Implementing CIFS" for details
    - */
    - if (bleft % 2) {
    - data[bleft] = 0;
    - ++bleft;
    - }
    -
    kfree(ses->serverOS);
    ses->serverOS = cifs_strndup_from_ucs(data, bleft, true, nls_cp);
    cFYI(1, "serverOS=%s", ses->serverOS);



    \
     
     \ /
      Last update: 2011-05-19 20:09    [W:4.520 / U:0.412 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site