]> git.ipfire.org Git - people/arne_f/kernel.git/commit
CIFS: Fix a potencially linear read overflow
authorLen Baker <len.baker@gmx.com>
Tue, 17 Aug 2021 10:27:09 +0000 (12:27 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 22 Sep 2021 09:41:21 +0000 (11:41 +0200)
commit0955df2d9bf4857e3e2287e3028903e6cec06c30
treecf1e52eccb68aa93cc407167e8898255c736d94a
parent4179f4376ecb2b89d4fa31e7d1e6f2721b618f0d
CIFS: Fix a potencially linear read overflow

[ Upstream commit f980d055a0f858d73d9467bb0b570721bbfcdfb8 ]

strlcpy() reads the entire source buffer first. This read may exceed the
destination size limit. This is both inefficient and can lead to linear
read overflows if a source string is not NUL-terminated.

Also, the strnlen() call does not avoid the read overflow in the strlcpy
function when a not NUL-terminated string is passed.

So, replace this block by a call to kstrndup() that avoids this type of
overflow and does the same.

Fixes: 066ce6899484d ("cifs: rename cifs_strlcpy_to_host and make it use new functions")
Signed-off-by: Len Baker <len.baker@gmx.com>
Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/cifs/cifs_unicode.c