]> git.kernelconcepts.de Git - karo-tx-linux.git/commit
cifs: Fix unicode string area word alignment in session setup
authorJeff Layton <jlayton@redhat.com>
Sat, 9 May 2009 06:04:21 +0000 (11:34 +0530)
committerGreg Kroah-Hartman <gregkh@suse.de>
Mon, 18 May 2009 23:35:01 +0000 (16:35 -0700)
commit5a12457e62aab1e19aa1b1d9bdbe53f26e9ed689
treec85ae63650ee9704a2eec5c86fd498b73482b090
parenta7a7d2fe8813c3bee7d7db9ba889fc2c2dd39dd7
cifs: Fix unicode string area word alignment in session setup

commit 27b87fe52baba0a55e9723030e76fce94fabcea4 refreshed.

cifs: fix unicode string area word alignment in session setup

The handling of unicode string area alignment is wrong.
decode_unicode_ssetup improperly assumes that it will always be preceded
by a pad byte. This isn't the case if the string area is already
word-aligned.

This problem, combined with the bad buffer sizing for the serverDomain
string can cause memory corruption. The bad alignment can make it so
that the alignment of the characters is off. This can make them
translate to characters that are greater than 2 bytes each. If this
happens we can overflow the allocation.

Fix this by fixing the alignment in CIFS_SessSetup instead so we can
verify it against the head of the response. Also, clean up the
workaround for improperly terminated strings by checking for a
odd-length unicode buffers and then forcibly terminating them.

Finally, resize the buffer for serverDomain. Now that we've fixed
the alignment, it's probably fine, but a malicious server could
overflow it.

A better solution for handling these strings is still needed, but
this should be a suitable bandaid.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Cc: Suresh Jayaraman <sjayaraman@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
fs/cifs/sess.c