On Fri, 19 Jul 2013 09:01:36 +0800 Chen Gang <[email protected]> wrote:
> For cifs_set_cifscreds() in "fs/cifs/connect.c", 'desc' buffer length > is 'CIFSCREDS_DESC_SIZE' (56 is less than 256), and 'ses->domainName' > length may be "255 + '\0'". > > The related sprintf() may cause memory overflow, so need extend related > buffer enough to hold all things. > > It is also necessary to be sure of 'ses->domainName' must be less than > 256, and define the related macro instead of hard code number '256'. > > Signed-off-by: Chen Gang <[email protected]> > --- > fs/cifs/cifsencrypt.c | 2 +- > fs/cifs/cifsglob.h | 1 + > fs/cifs/connect.c | 7 ++++--- > fs/cifs/sess.c | 6 +++--- > 4 files changed, 9 insertions(+), 7 deletions(-) > > diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c > index 45e57cc..bb84d7c 100644 > --- a/fs/cifs/cifsencrypt.c > +++ b/fs/cifs/cifsencrypt.c > @@ -421,7 +421,7 @@ find_domain_name(struct cifs_ses *ses, const struct > nls_table *nls_cp) > if (blobptr + attrsize > blobend) > break; > if (type == NTLMSSP_AV_NB_DOMAIN_NAME) { > - if (!attrsize) > + if (!attrsize || attrsize >= MAX_DOMAINNAME_SIZE) > break; > if (!ses->domainName) { > ses->domainName = > diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h > index 33f17ed..64bb4c5 100644 > --- a/fs/cifs/cifsglob.h > +++ b/fs/cifs/cifsglob.h > @@ -44,6 +44,7 @@ > #define MAX_TREE_SIZE (2 + MAX_SERVER_SIZE + 1 + MAX_SHARE_SIZE + 1) > #define MAX_SERVER_SIZE 15 > #define MAX_SHARE_SIZE 80 > +#define MAX_DOMAINNAME_SIZE 256 /* maximum fully qualified domain name > (FQDN) */ > #define MAX_USERNAME_SIZE 256 /* reasonable maximum for current > servers */ > #define MAX_PASSWORD_SIZE 512 /* max for windows seems to be 256 wide > chars */ > > diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c > index fa68813..3f9dcf7 100644 > --- a/fs/cifs/connect.c > +++ b/fs/cifs/connect.c > @@ -1675,7 +1675,8 @@ cifs_parse_mount_options(const char *mountdata, const > char *devname, > if (string == NULL) > goto out_nomem; > > - if (strnlen(string, 256) == 256) { > + if (strnlen(string, MAX_DOMAINNAME_SIZE) > + == MAX_DOMAINNAME_SIZE) { > printk(KERN_WARNING "CIFS: domain name too" > " long\n"); > goto cifs_parse_mount_err; > @@ -2276,8 +2277,8 @@ cifs_put_smb_ses(struct cifs_ses *ses) > > #ifdef CONFIG_KEYS > > -/* strlen("cifs:a:") + INET6_ADDRSTRLEN + 1 */ > -#define CIFSCREDS_DESC_SIZE (7 + INET6_ADDRSTRLEN + 1) > +/* strlen("cifs:a:") + MAX_DOMAINNAME_SIZE + 1 */ > +#define CIFSCREDS_DESC_SIZE (7 + MAX_DOMAINNAME_SIZE + 1) > > /* Populate username and pw fields from keyring if possible */ > static int > diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c > index 79358e3..57b1537 100644 > --- a/fs/cifs/sess.c > +++ b/fs/cifs/sess.c > @@ -197,7 +197,7 @@ static void unicode_domain_string(char **pbcc_area, > struct cifs_ses *ses, > bytes_ret = 0; > } else > bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName, > - 256, nls_cp); > + MAX_DOMAINNAME_SIZE, nls_cp); > bcc_ptr += 2 * bytes_ret; > bcc_ptr += 2; /* account for null terminator */ > > @@ -255,8 +255,8 @@ static void ascii_ssetup_strings(char **pbcc_area, struct > cifs_ses *ses, > > /* copy domain */ > if (ses->domainName != NULL) { > - strncpy(bcc_ptr, ses->domainName, 256); > - bcc_ptr += strnlen(ses->domainName, 256); > + strncpy(bcc_ptr, ses->domainName, MAX_DOMAINNAME_SIZE); > + bcc_ptr += strnlen(ses->domainName, MAX_DOMAINNAME_SIZE); > } /* else we will send a null domain name > so the server will default to its own domain */ > *bcc_ptr = 0; Looks good... Reviewed-by: Jeff Layton <[email protected]> -- To unsubscribe from this list: send the line "unsubscribe linux-cifs" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
