Unverified Commit bf9239af authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!4066 smb: client: fix OOB in receive_encrypted_standard() 

Merge Pull Request from: @ci-robot 
 
PR sync from: ZhaoLong Wang <wangzhaolong1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/MG4ELKOMJSCP2O3IAWCGU5EWYSXDO7P6/ 
 
https://gitee.com/src-openeuler/kernel/issues/I8WEOK 
 
Link:https://gitee.com/openeuler/kernel/pulls/4066

 

Reviewed-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parents bea24419 c622e096

fs/smb/client/smb2ops.c

+8 −6
Original line number Diff line number Diff line
@@ -4937,6 +4937,7 @@ receive_encrypted_standard(struct TCP_Server_Info *server, 
	struct smb2_hdr *shdr;

	unsigned int pdu_length = server->pdu_size;

	unsigned int buf_size;

	unsigned int next_cmd;

	struct mid_q_entry *mid_entry;

	int next_is_large;

	char *next_buffer = NULL;
@@ -4965,14 +4966,15 @@ receive_encrypted_standard(struct TCP_Server_Info *server, 
	next_is_large = server->large_buf;

one_more:

	shdr = (struct smb2_hdr *)buf;

	if (shdr->NextCommand) {

	next_cmd = le32_to_cpu(shdr->NextCommand);

	if (next_cmd) {

		if (WARN_ON_ONCE(next_cmd > pdu_length))

			return -1;

		if (next_is_large)

			next_buffer = (char *)cifs_buf_get();

		else

			next_buffer = (char *)cifs_small_buf_get();

		memcpy(next_buffer,

		       buf + le32_to_cpu(shdr->NextCommand),

		       pdu_length - le32_to_cpu(shdr->NextCommand));

		memcpy(next_buffer, buf + next_cmd, pdu_length - next_cmd);

	}



	mid_entry = smb2_find_mid(server, buf);
@@ -4996,8 +4998,8 @@ receive_encrypted_standard(struct TCP_Server_Info *server, 
	else

		ret = cifs_handle_standard(server, mid_entry);



	if (ret == 0 && shdr->NextCommand) {

		pdu_length -= le32_to_cpu(shdr->NextCommand);

	if (ret == 0 && next_cmd) {

		pdu_length -= next_cmd;

		server->large_buf = next_is_large;

		if (next_is_large)

			server->bigbuf = buf = next_buffer;