Commit 7250170c authored Jan 11, 2012 by Dan Carpenter Committed by Steve French Jan 12, 2012

cifs: integer overflow in parse_dacl()



On 32 bit systems num_aces * sizeof(struct cifs_ace *) could overflow
leading to a smaller ppace buffer than we expected.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Jeff Layton <jlayton@samba.org>
Signed-off-by: Steve French <smfrench@gmail.com>

parent a429638c

fs/cifs/cifsacl.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -909,6 +909,8 @@ static void parse_dacl(struct cifs_acl pdacl, char end_of_acl,
		umode_t group_mask = S_IRWXG;
		umode_t other_mask = S_IRWXU \| S_IRWXG \| S_IRWXO;

		if (num_aces > ULONG_MAX / sizeof(struct cifs_ace *))
		return;
		ppace = kmalloc(num_aces * sizeof(struct cifs_ace *),
		GFP_KERNEL);
		if (!ppace) {