| Date | Sun, 8 Sep 2013 23:03:53 -0400 | Subject | Re: [052/121] cifs: extend the buffer length enought for sprintf() using | From | Scott Lovenberg <> |
| |
On Sat, Sep 7, 2013 at 10:52 PM, Ben Hutchings <ben@decadent.org.uk> wrote: > > 3.2.51-rc1 review patch. If anyone has any objections, please let me know. > > ------------------ > > From: Chen Gang <gang.chen@asianux.com> > > commit 057d6332b24a4497c55a761c83c823eed9e3f23b upstream. > > For cifs_set_cifscreds() in "fs/cifs/connect.c", 'desc' buffer length > is 'CIFSCREDS_DESC_SIZE' (56 is less than 256), and 'ses->domainName' > length may be "255 + '\0'". > > The related sprintf() may cause memory overflow, so need extend related > buffer enough to hold all things. > > It is also necessary to be sure of 'ses->domainName' must be less than > 256, and define the related macro instead of hard code number '256'. > > Signed-off-by: Chen Gang <gang.chen@asianux.com> > Reviewed-by: Jeff Layton <jlayton@redhat.com> > Reviewed-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com> > Reviewed-by: Scott Lovenberg <scott.lovenberg@gmail.com> > Signed-off-by: Steve French <smfrench@gmail.com> > [bwh: Backported to 3.2: > - Adjust context in sess.c > - Drop inapplicable changes to connect.c] > Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Looks good to me.
-- Peace and Blessings, -Scott.
|