]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ksmbd: validate zero num_subauth before sub_auth is accessed
authorNorbert Szetei <norbert@doyensec.com>
Sat, 29 Mar 2025 16:06:01 +0000 (16:06 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 10 Apr 2025 12:39:39 +0000 (14:39 +0200)
commit56de7778a48560278c334077ace7b9ac4bfb2fd1
treef4baf0651e21fc7a990e19491a6b08262a0a129e
parent6a9cd9ff0fa2bcc30b2bfb8bdb161eb20e44b9dc
ksmbd: validate zero num_subauth before sub_auth is accessed

commit bf21e29d78cd2c2371023953d9c82dfef82ebb36 upstream.

Access psid->sub_auth[psid->num_subauth - 1] without checking
if num_subauth is non-zero leads to an out-of-bounds read.
This patch adds a validation step to ensure num_subauth != 0
before sub_auth is accessed.

Cc: stable@vger.kernel.org
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/smb/server/smbacl.c