Loading fs/cifs/cifssmb.c +38 −42 Original line number Diff line number Diff line Loading @@ -2564,7 +2564,6 @@ validate_ntransact(char *buf, char **ppparm, char **ppdata, *pparmlen = parm_count; return 0; } #endif /* CIFS_EXPERIMENTAL */ int CIFSSMBQueryReparseLinkInfo(const int xid, struct cifsTconInfo *tcon, Loading Loading @@ -2611,14 +2610,14 @@ CIFSSMBQueryReparseLinkInfo(const int xid, struct cifsTconInfo *tcon, } else { /* decode response */ __u32 data_offset = le32_to_cpu(pSMBr->DataOffset); __u32 data_count = le32_to_cpu(pSMBr->DataCount); if ((pSMBr->ByteCount < 2) || (data_offset > 512)) if ((pSMBr->ByteCount < 2) || (data_offset > 512)) { /* BB also check enough total bytes returned */ rc = -EIO; /* bad smb */ else { goto qreparse_out; } if (data_count && (data_count < 2048)) { char *end_of_smb = 2 /* sizeof byte count */ + pSMBr->ByteCount + (char *)&pSMBr->ByteCount; pSMBr->ByteCount + (char *)&pSMBr->ByteCount; struct reparse_data *reparse_buf = (struct reparse_data *) Loading @@ -2630,23 +2629,19 @@ CIFSSMBQueryReparseLinkInfo(const int xid, struct cifsTconInfo *tcon, } if ((reparse_buf->LinkNamesBuf + reparse_buf->TargetNameOffset + reparse_buf->TargetNameLen) > end_of_smb) { reparse_buf->TargetNameLen) > end_of_smb) { cFYI(1, ("reparse buf beyond SMB")); rc = -EIO; goto qreparse_out; } if (pSMBr->hdr.Flags2 & SMBFLG2_UNICODE) { name_len = UniStrnlen((wchar_t *) cifs_from_ucs2(symlinkinfo, (__le16 *) (reparse_buf->LinkNamesBuf + reparse_buf->TargetNameOffset), min(buflen/2, reparse_buf->TargetNameLen / 2)); cifs_strfromUCS_le(symlinkinfo, (__le16 *) (reparse_buf->LinkNamesBuf + reparse_buf->TargetNameOffset), name_len, nls_codepage); buflen, reparse_buf->TargetNameLen, nls_codepage, 0); } else { /* ASCII names */ strncpy(symlinkinfo, reparse_buf->LinkNamesBuf + Loading @@ -2663,7 +2658,7 @@ CIFSSMBQueryReparseLinkInfo(const int xid, struct cifsTconInfo *tcon, does not go off the end of the buffer */ cFYI(1, ("readlink result - %s", symlinkinfo)); } } qreparse_out: cifs_buf_release(pSMB); Loading @@ -2672,6 +2667,7 @@ CIFSSMBQueryReparseLinkInfo(const int xid, struct cifsTconInfo *tcon, return rc; } #endif /* CIFS_EXPERIMENTAL */ #ifdef CONFIG_CIFS_POSIX Loading Loading
fs/cifs/cifssmb.c +38 −42 Original line number Diff line number Diff line Loading @@ -2564,7 +2564,6 @@ validate_ntransact(char *buf, char **ppparm, char **ppdata, *pparmlen = parm_count; return 0; } #endif /* CIFS_EXPERIMENTAL */ int CIFSSMBQueryReparseLinkInfo(const int xid, struct cifsTconInfo *tcon, Loading Loading @@ -2611,14 +2610,14 @@ CIFSSMBQueryReparseLinkInfo(const int xid, struct cifsTconInfo *tcon, } else { /* decode response */ __u32 data_offset = le32_to_cpu(pSMBr->DataOffset); __u32 data_count = le32_to_cpu(pSMBr->DataCount); if ((pSMBr->ByteCount < 2) || (data_offset > 512)) if ((pSMBr->ByteCount < 2) || (data_offset > 512)) { /* BB also check enough total bytes returned */ rc = -EIO; /* bad smb */ else { goto qreparse_out; } if (data_count && (data_count < 2048)) { char *end_of_smb = 2 /* sizeof byte count */ + pSMBr->ByteCount + (char *)&pSMBr->ByteCount; pSMBr->ByteCount + (char *)&pSMBr->ByteCount; struct reparse_data *reparse_buf = (struct reparse_data *) Loading @@ -2630,23 +2629,19 @@ CIFSSMBQueryReparseLinkInfo(const int xid, struct cifsTconInfo *tcon, } if ((reparse_buf->LinkNamesBuf + reparse_buf->TargetNameOffset + reparse_buf->TargetNameLen) > end_of_smb) { reparse_buf->TargetNameLen) > end_of_smb) { cFYI(1, ("reparse buf beyond SMB")); rc = -EIO; goto qreparse_out; } if (pSMBr->hdr.Flags2 & SMBFLG2_UNICODE) { name_len = UniStrnlen((wchar_t *) cifs_from_ucs2(symlinkinfo, (__le16 *) (reparse_buf->LinkNamesBuf + reparse_buf->TargetNameOffset), min(buflen/2, reparse_buf->TargetNameLen / 2)); cifs_strfromUCS_le(symlinkinfo, (__le16 *) (reparse_buf->LinkNamesBuf + reparse_buf->TargetNameOffset), name_len, nls_codepage); buflen, reparse_buf->TargetNameLen, nls_codepage, 0); } else { /* ASCII names */ strncpy(symlinkinfo, reparse_buf->LinkNamesBuf + Loading @@ -2663,7 +2658,7 @@ CIFSSMBQueryReparseLinkInfo(const int xid, struct cifsTconInfo *tcon, does not go off the end of the buffer */ cFYI(1, ("readlink result - %s", symlinkinfo)); } } qreparse_out: cifs_buf_release(pSMB); Loading @@ -2672,6 +2667,7 @@ CIFSSMBQueryReparseLinkInfo(const int xid, struct cifsTconInfo *tcon, return rc; } #endif /* CIFS_EXPERIMENTAL */ #ifdef CONFIG_CIFS_POSIX Loading