diff options
-rw-r--r-- | fs/cifs/cifssmb.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c index e6374dda3c6a..64dad47641a1 100644 --- a/fs/cifs/cifssmb.c +++ b/fs/cifs/cifssmb.c | |||
@@ -339,12 +339,13 @@ static int validate_t2(struct smb_t2_rsp *pSMB) | |||
339 | get_unaligned_le16(&pSMB->t2_rsp.DataOffset) > 1024) | 339 | get_unaligned_le16(&pSMB->t2_rsp.DataOffset) > 1024) |
340 | goto vt2_err; | 340 | goto vt2_err; |
341 | 341 | ||
342 | /* check that bcc is at least as big as parms + data */ | ||
343 | /* check that bcc is less than negotiated smb buffer */ | ||
344 | total_size = get_unaligned_le16(&pSMB->t2_rsp.ParameterCount); | 342 | total_size = get_unaligned_le16(&pSMB->t2_rsp.ParameterCount); |
345 | if (total_size >= 512) | 343 | if (total_size >= 512) |
346 | goto vt2_err; | 344 | goto vt2_err; |
347 | 345 | ||
346 | /* check that bcc is at least as big as parms + data, and that it is | ||
347 | * less than negotiated smb buffer | ||
348 | */ | ||
348 | total_size += get_unaligned_le16(&pSMB->t2_rsp.DataCount); | 349 | total_size += get_unaligned_le16(&pSMB->t2_rsp.DataCount); |
349 | if (total_size > get_bcc(&pSMB->hdr) || | 350 | if (total_size > get_bcc(&pSMB->hdr) || |
350 | total_size >= CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) | 351 | total_size >= CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) |