From ed4111d0230f6c95c7146192a84a20789abd7c65 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Tue, 31 Jan 2012 11:52:01 +0300 Subject: [PATCH] --- yaml --- r: 287287 b: refs/heads/master c: 4991a5faab7368daac463181e786608b4eb63675 h: refs/heads/master i: 287285: 5769960bf131608b5e90ee0d5ecf6038bc559b27 287283: d07d74aa9f8d63a727faf08a115c169afd56bcb1 287279: dfc93abe0145faede58e47f156d0eae53adec84e v: v3 --- [refs] | 2 +- trunk/fs/cifs/sess.c | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/[refs] b/[refs] index 938830a2ce64..42fba2ec05bc 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: 803ab977618eae2b292cda0a97eed75f42250ddf +refs/heads/master: 4991a5faab7368daac463181e786608b4eb63675 diff --git a/trunk/fs/cifs/sess.c b/trunk/fs/cifs/sess.c index d85efad5765f..eb767412177d 100644 --- a/trunk/fs/cifs/sess.c +++ b/trunk/fs/cifs/sess.c @@ -395,6 +395,10 @@ static int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len, ses->ntlmssp->server_flags = le32_to_cpu(pblob->NegotiateFlags); tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset); tilen = le16_to_cpu(pblob->TargetInfoArray.Length); + if (tioffset > blob_len || tioffset + tilen > blob_len) { + cERROR(1, "tioffset + tilen too high %u + %u", tioffset, tilen); + return -EINVAL; + } if (tilen) { ses->auth_key.response = kmalloc(tilen, GFP_KERNEL); if (!ses->auth_key.response) {