On Tue, Jan 31, 2012 at 05:49:37AM -0500, Jeff Layton wrote: > On Tue, 31 Jan 2012 11:52:01 +0300 > Dan Carpenter <[email protected]> wrote: > > > We should check that we're not copying memory from beyond the end of the > > blob. > > > > Signed-off-by: Dan Carpenter <[email protected]> > > > > diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c > > index d85efad..eb76741 100644 > > --- a/fs/cifs/sess.c > > +++ b/fs/cifs/sess.c > > @@ -395,6 +395,10 @@ static int decode_ntlmssp_challenge(char *bcc_ptr, int > > blob_len, > > ses->ntlmssp->server_flags = le32_to_cpu(pblob->NegotiateFlags); > > tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset); > > tilen = le16_to_cpu(pblob->TargetInfoArray.Length); > > + if (tioffset > blob_len || tioffset + tilen > blob_len) { > > + cERROR(1, "tioffset + tilen too high %u + %u", tioffset, tilen); > > + return -EINVAL; > > + } > > Good catch. > > Do we really need a || here though? Would it not be sufficient to check > if tioffset + tilen > blob_len? Or are you concerned about that value > wrapping?
Yep. I was concerned about value wrapping. regards, dan carpenter
signature.asc
Description: Digital signature
