CIFS: Fix a potencially linear read overflow

[ Upstream commit f980d055a0f858d73d9467bb0b570721bbfcdfb8 ]

strlcpy() reads the entire source buffer first. This read may exceed the
destination size limit. This is both inefficient and can lead to linear
read overflows if a source string is not NUL-terminated.

Also, the strnlen() call does not avoid the read overflow in the strlcpy
function when a not NUL-terminated string is passed.

So, replace this block by a call to kstrndup() that avoids this type of
overflow and does the same.

Fixes: 066ce6899484d ("cifs: rename cifs_strlcpy_to_host and make it use new functions")
Signed-off-by: Len Baker <len.baker@gmx.com>
Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index 942874257a092e20fafa8e2a2fa6edf59b015f3c..e5e780145728042c489898aa47179f48bdf35ab2 100644 (file)
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -367,14 +367,9 @@ cifs_strndup_from_utf16(const char *src, const int maxlen,
                if (!dst)
                        return NULL;
                cifs_from_utf16(dst, (__le16 *) src, len, maxlen, codepage,
-                              NO_MAP_UNI_RSVD);
+                               NO_MAP_UNI_RSVD);
        } else {
-               len = strnlen(src, maxlen);
-               len++;
-               dst = kmalloc(len, GFP_KERNEL);
-               if (!dst)
-                       return NULL;
-               strlcpy(dst, src, len);
+               dst = kstrndup(src, maxlen, GFP_KERNEL);
        }
 
        return dst;