aboutsummaryrefslogtreecommitdiffstats
path: root/fs/cifs
diff options
context:
space:
mode:
authorJeff Layton <jlayton@redhat.com>2008-12-17 06:31:53 -0500
committerLinus Torvalds <torvalds@linux-foundation.org>2008-12-17 17:59:55 -0500
commit331c31351044888916805c9cb32d8bb9e40c12e9 (patch)
tree41b7d9c95c1e5e1f413c3b026a26979c34d0b3e0 /fs/cifs
parenta52519f2ce180890069fa7b1a92fa51d4448a0ba (diff)
cifs: fix buffer overrun in parse_DFS_referrals
While testing a kernel with memory poisoning enabled, I saw some warnings about the redzone getting clobbered when chasing DFS referrals. The buffer allocation for the unicode converted version of the searchName is too small and needs to take null termination into account. Signed-off-by: Jeff Layton <jlayton@redhat.com> Acked-by: Steve French <sfrench@us.ibm.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/cifs')
-rw-r--r--fs/cifs/cifssmb.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 2af8626ced43..6d51696dc762 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -3983,7 +3983,8 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
3983 3983
3984 node->flags = le16_to_cpu(pSMBr->DFSFlags); 3984 node->flags = le16_to_cpu(pSMBr->DFSFlags);
3985 if (is_unicode) { 3985 if (is_unicode) {
3986 __le16 *tmp = kmalloc(strlen(searchName)*2, GFP_KERNEL); 3986 __le16 *tmp = kmalloc(strlen(searchName)*2 + 2,
3987 GFP_KERNEL);
3987 cifsConvertToUCS((__le16 *) tmp, searchName, 3988 cifsConvertToUCS((__le16 *) tmp, searchName,
3988 PATH_MAX, nls_codepage, remap); 3989 PATH_MAX, nls_codepage, remap);
3989 node->path_consumed = hostlen_fromUCS(tmp, 3990 node->path_consumed = hostlen_fromUCS(tmp,