On Sun, 13 Oct 2013 13:29:03 -0600 Tim Gardner <[email protected]> wrote:
> Functions that walk the ntstatus_to_dos_map[] array could > run off the end. For example, ntstatus_to_dos() loops > while ntstatus_to_dos_map[].ntstatus is not 0. Granted, > this is mostly theoretical, but could be used as a DOS attack > if the error code in the SMB header is bogus. > > Cc: Steve French <[email protected]> > Signed-off-by: Tim Gardner <[email protected]> > --- > fs/cifs/netmisc.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c > index af847e1..651a527 100644 > --- a/fs/cifs/netmisc.c > +++ b/fs/cifs/netmisc.c > @@ -780,7 +780,9 @@ static const struct { > ERRDOS, ERRnoaccess, 0xc0000290}, { > ERRDOS, ERRbadfunc, 0xc000029c}, { > ERRDOS, ERRsymlink, NT_STATUS_STOPPED_ON_SYMLINK}, { > - ERRDOS, ERRinvlevel, 0x007c0001}, }; > + ERRDOS, ERRinvlevel, 0x007c0001}, { > + 0, 0, 0 } > +}; > > > /***************************************************************************** > Print an error message from the status code Nice catch. Reviewed-by: Jeff Layton <[email protected]> -- To unsubscribe from this list: send the line "unsubscribe linux-cifs" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
