summaryrefslogtreecommitdiff
path: root/fs/cifs/sess.c
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2012-01-31 12:52:01 +0400
committerSteve French <smfrench@gmail.com>2012-01-31 17:42:06 +0400
commit4991a5faab7368daac463181e786608b4eb63675 (patch)
treede09a9fbbfae716c5dc2cb57a1f83a0460a8c8f4 /fs/cifs/sess.c
parent803ab977618eae2b292cda0a97eed75f42250ddf (diff)
downloadlinux-4991a5faab7368daac463181e786608b4eb63675.tar.xz
cifs: check offset in decode_ntlmssp_challenge()
We should check that we're not copying memory from beyond the end of the blob. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Jeff Layton <jlayton@redhat.com>
Diffstat (limited to 'fs/cifs/sess.c')
-rw-r--r--fs/cifs/sess.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index d85efad5765f..eb767412177d 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -395,6 +395,10 @@ static int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
ses->ntlmssp->server_flags = le32_to_cpu(pblob->NegotiateFlags);
tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
+ if (tioffset > blob_len || tioffset + tilen > blob_len) {
+ cERROR(1, "tioffset + tilen too high %u + %u", tioffset, tilen);
+ return -EINVAL;
+ }
if (tilen) {
ses->auth_key.response = kmalloc(tilen, GFP_KERNEL);
if (!ses->auth_key.response) {