Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4991a5fa authored by Dan Carpenter's avatar Dan Carpenter Committed by Steve French
Browse files

cifs: check offset in decode_ntlmssp_challenge() 



We should check that we're not copying memory from beyond the end of the
blob.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarJeff Layton <jlayton@redhat.com>
parent 803ab977

fs/cifs/sess.c

+4 −0
Original line number Diff line number Diff line
@@ -395,6 +395,10 @@ static int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len, 
	ses->ntlmssp->server_flags = le32_to_cpu(pblob->NegotiateFlags);

	tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);

	tilen = le16_to_cpu(pblob->TargetInfoArray.Length);

	if (tioffset > blob_len || tioffset + tilen > blob_len) {

		cERROR(1, "tioffset + tilen too high %u + %u", tioffset, tilen);

		return -EINVAL;

	}

	if (tilen) {

		ses->auth_key.response = kmalloc(tilen, GFP_KERNEL);

		if (!ses->auth_key.response) {