diff options
| author |   Zisen Ye <zisenye@stu.xidian.edu.cn> | 2026-05-02 18:48:36 +0800 |
|---|---|---|
| committer |   Steve French <stfrench@microsoft.com> | 2026-05-07 14:09:29 -0500 |
| commit | d62b8d236fab503c6fec1d3e9a38bea71feaca20 (patch) | |
| tree | fe51b8cdc8236c5f66fbf7b63bec9d9b8ae516a8 /tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com | |
| parent | smb: client: Zero-pad short GSS session keys per MS-SMB2 (diff) | |
smb/client: fix out-of-bounds read in symlink_data()
Since smb2_check_message() returns success without length validation for
the symlink error response, in symlink_data() it is possible for
iov->iov_len to be smaller than sizeof(struct smb2_err_rsp). If the buffer
only contains the base SMB2 header (64 bytes), accessing
err->ErrorContextCount (at offset 66) or err->ByteCount later in
symlink_data() will cause an out-of-bounds read.
Link: https://lore.kernel.org/linux-cifs/297d8d9b-adf7-42fd-a1c2-5b1f230032bc@chenxiaosong.com/
Fixes: 76894f3e2f71 ("cifs: improve symlink handling for smb2+")
Cc: Stable@vger.kernel.org
Signed-off-by: Zisen Ye <zisenye@stu.xidian.edu.cn>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions