[PATCH] cifs: improve check for search entry going beyond end of SMB transact

Signed-off-by: Steve French (sfrench@us.ibm.com)
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

1 files changed, 8 insertions, 3 deletions

diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 39170cffcad8..22557716f9af 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -409,10 +409,15 @@ static char *nxt_dir_entry(char *old_entry, char *end_of_smb)
         cFYI(1,("new entry %p old entry %p",new_entry,old_entry));
         /* validate that new_entry is not past end of SMB */
         if(new_entry >= end_of_smb) {
-                cFYI(1,("search entry %p began after end of SMB %p old entry %p",
-                        new_entry,end_of_smb,old_entry)); 
+                cERROR(1,
+                      ("search entry %p began after end of SMB %p old entry %p",
+                        new_entry, end_of_smb, old_entry)); 
                 return NULL;
-        } else
+        } else if (new_entry + sizeof(FILE_DIRECTORY_INFO) > end_of_smb) {
+                cERROR(1,("search entry %p extends after end of SMB %p",
+                        new_entry, end_of_smb));
+                return NULL;
+        } else 
                 return new_entry;
 
 }