Unverified Commit f99278bc authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!3671 smb: client: fix OOB in smbCalcSize() 

Merge Pull Request from: @ci-robot 
 
PR sync from: ZhaoLong Wang <wangzhaolong1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/IA5CK543DF4LV3JCYAKCZHYK3U3GXJXT/ 
 
https://gitee.com/src-openeuler/kernel/issues/I8MXXW 
 
Link:https://gitee.com/openeuler/kernel/pulls/3671

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Reviewed-by: default avatarzhangyi (F) <yi.zhang@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 0e1a9c9e 8e266ede

fs/cifs/misc.c

+4 −0
Original line number Diff line number Diff line
@@ -344,6 +344,10 @@ checkSMB(char *buf, unsigned int total_read, struct TCP_Server_Info *server) 
			cifs_dbg(VFS, "Length less than smb header size\n");

		}

		return -EIO;

	} else if (total_read < sizeof(*smb) + 2 * smb->WordCount) {

		cifs_dbg(VFS, "%s: can't read BCC due to invalid WordCount(%u)\n",

			 __func__, smb->WordCount);

		return -EIO;

	}



	/* otherwise, there is enough to get to the BCC */