]> git.baikalelectronics.ru Git - kernel.git/commit
CIFS: Fix a potencially linear read overflow
authorLen Baker <len.baker@gmx.com>
Tue, 17 Aug 2021 10:27:09 +0000 (12:27 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 15 Sep 2021 07:47:36 +0000 (09:47 +0200)
commitf8e49b556d041aaf03ac3481b0c094757f6d8f6d
tree79218ca203bef0a91fa83db612ba2f4ac30fea5c
parentb170595942785ed4945dca4091bb4014bebf48b6
CIFS: Fix a potencially linear read overflow

[ Upstream commit f980d055a0f858d73d9467bb0b570721bbfcdfb8 ]

strlcpy() reads the entire source buffer first. This read may exceed the
destination size limit. This is both inefficient and can lead to linear
read overflows if a source string is not NUL-terminated.

Also, the strnlen() call does not avoid the read overflow in the strlcpy
function when a not NUL-terminated string is passed.

So, replace this block by a call to kstrndup() that avoids this type of
overflow and does the same.

Fixes: 13a7987d93664 ("cifs: rename cifs_strlcpy_to_host and make it use new functions")
Signed-off-by: Len Baker <len.baker@gmx.com>
Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/cifs/cifs_unicode.c