]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ksmbd: validate zero num_subauth before sub_auth is accessed
authorNorbert Szetei <norbert@doyensec.com>
Sat, 29 Mar 2025 16:06:01 +0000 (16:06 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 10 Apr 2025 12:37:43 +0000 (14:37 +0200)
commit0e36a3e080d6d8bd7a34e089345d043da4ac8283
treeb0cc857d12c6bceabd9ae74b65d1289990a2ea8f
parent3980770cb1470054e6400fd97668665975726737
ksmbd: validate zero num_subauth before sub_auth is accessed

commit bf21e29d78cd2c2371023953d9c82dfef82ebb36 upstream.

Access psid->sub_auth[psid->num_subauth - 1] without checking
if num_subauth is non-zero leads to an out-of-bounds read.
This patch adds a validation step to ensure num_subauth != 0
before sub_auth is accessed.

Cc: stable@vger.kernel.org
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/smb/server/smbacl.c