aboutsummaryrefslogtreecommitdiffstats
path: root/fs/cifs/asn1.c
diff options
context:
space:
mode:
authorChris Wright <chrisw@sous-sol.org>2008-06-04 12:16:33 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2008-06-05 17:24:54 -0400
commitddb2c43594f22843e9f3153da151deaba1a834c5 (patch)
tree7eeeca2fa55e9ef45c381b01d9e3ec1b726297c1 /fs/cifs/asn1.c
parentefedf51c866130945b5db755cb58670e60205d83 (diff)
asn1: additional sanity checking during BER decoding
- Don't trust a length which is greater than the working buffer. An invalid length could cause overflow when calculating buffer size for decoding oid. - An oid length of zero is invalid and allows for an off-by-one error when decoding oid because the first subid actually encodes first 2 subids. - A primitive encoding may not have an indefinite length. Thanks to Wei Wang from McAfee for report. Cc: Steven French <sfrench@us.ibm.com> Cc: stable@kernel.org Acked-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/cifs/asn1.c')
-rw-r--r--fs/cifs/asn1.c14
1 files changed, 14 insertions, 0 deletions
diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
index cb52cbbe45ff..f58e41d3ba48 100644
--- a/fs/cifs/asn1.c
+++ b/fs/cifs/asn1.c
@@ -186,6 +186,11 @@ asn1_length_decode(struct asn1_ctx *ctx, unsigned int *def, unsigned int *len)
186 } 186 }
187 } 187 }
188 } 188 }
189
190 /* don't trust len bigger than ctx buffer */
191 if (*len > ctx->end - ctx->pointer)
192 return 0;
193
189 return 1; 194 return 1;
190} 195}
191 196
@@ -203,6 +208,10 @@ asn1_header_decode(struct asn1_ctx *ctx,
203 if (!asn1_length_decode(ctx, &def, &len)) 208 if (!asn1_length_decode(ctx, &def, &len))
204 return 0; 209 return 0;
205 210
211 /* primitive shall be definite, indefinite shall be constructed */
212 if (*con == ASN1_PRI && !def)
213 return 0;
214
206 if (def) 215 if (def)
207 *eoc = ctx->pointer + len; 216 *eoc = ctx->pointer + len;
208 else 217 else
@@ -389,6 +398,11 @@ asn1_oid_decode(struct asn1_ctx *ctx,
389 unsigned long *optr; 398 unsigned long *optr;
390 399
391 size = eoc - ctx->pointer + 1; 400 size = eoc - ctx->pointer + 1;
401
402 /* first subid actually encodes first two subids */
403 if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
404 return 0;
405
392 *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC); 406 *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
393 if (*oid == NULL) 407 if (*oid == NULL)
394 return 0; 408 return 0;