---

yaml --- r: 287287 b: refs/heads/master c: 4991a5f h: refs/heads/master i: 287285: 5769960 287283: d07d74a 287279: dfc93ab v: v3
git-mirror · Jan 31, 2012 · ed4111d · ed4111d
1 parent 2cd9fb3
commit ed4111d
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/[refs] b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 803ab977618eae2b292cda0a97eed75f42250ddf
+refs/heads/master: 4991a5faab7368daac463181e786608b4eb63675
diff --git a/trunk/fs/cifs/sess.c b/trunk/fs/cifs/sess.c
@@ -395,6 +395,10 @@ static int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
 	ses->ntlmssp->server_flags = le32_to_cpu(pblob->NegotiateFlags);
 	tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
 	tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
+	if (tioffset > blob_len || tioffset + tilen > blob_len) {
+		cERROR(1, "tioffset + tilen too high %u + %u", tioffset, tilen);
+		return -EINVAL;
+	}
 	if (tilen) {
 		ses->auth_key.response = kmalloc(tilen, GFP_KERNEL);
 		if (!ses->auth_key.response) {