aboutsummaryrefslogtreecommitdiffstats
path: root/fs/cifs
diff options
context:
space:
mode:
Diffstat (limited to 'fs/cifs')
-rw-r--r--fs/cifs/cifssmb.c38
1 files changed, 19 insertions, 19 deletions
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 30709589e0c9..f5e15279ea29 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -5281,7 +5281,7 @@ CIFSSMBQAllEAs(const int xid, struct cifsTconInfo *tcon,
5281 TRANSACTION2_QPI_RSP *pSMBr = NULL; 5281 TRANSACTION2_QPI_RSP *pSMBr = NULL;
5282 int rc = 0; 5282 int rc = 0;
5283 int bytes_returned; 5283 int bytes_returned;
5284 int name_len; 5284 int list_len;
5285 struct fealist *ea_response_data; 5285 struct fealist *ea_response_data;
5286 struct fea *temp_fea; 5286 struct fea *temp_fea;
5287 char *temp_ptr; 5287 char *temp_ptr;
@@ -5295,18 +5295,18 @@ QAllEAsRetry:
5295 return rc; 5295 return rc;
5296 5296
5297 if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) { 5297 if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
5298 name_len = 5298 list_len =
5299 cifsConvertToUCS((__le16 *) pSMB->FileName, searchName, 5299 cifsConvertToUCS((__le16 *) pSMB->FileName, searchName,
5300 PATH_MAX, nls_codepage, remap); 5300 PATH_MAX, nls_codepage, remap);
5301 name_len++; /* trailing null */ 5301 list_len++; /* trailing null */
5302 name_len *= 2; 5302 list_len *= 2;
5303 } else { /* BB improve the check for buffer overruns BB */ 5303 } else { /* BB improve the check for buffer overruns BB */
5304 name_len = strnlen(searchName, PATH_MAX); 5304 list_len = strnlen(searchName, PATH_MAX);
5305 name_len++; /* trailing null */ 5305 list_len++; /* trailing null */
5306 strncpy(pSMB->FileName, searchName, name_len); 5306 strncpy(pSMB->FileName, searchName, list_len);
5307 } 5307 }
5308 5308
5309 params = 2 /* level */ + 4 /* reserved */ + name_len /* includes NUL */; 5309 params = 2 /* level */ + 4 /* reserved */ + list_len /* includes NUL */;
5310 pSMB->TotalDataCount = 0; 5310 pSMB->TotalDataCount = 0;
5311 pSMB->MaxParameterCount = cpu_to_le16(2); 5311 pSMB->MaxParameterCount = cpu_to_le16(2);
5312 /* BB find exact max SMB PDU from sess structure BB */ 5312 /* BB find exact max SMB PDU from sess structure BB */
@@ -5361,23 +5361,23 @@ QAllEAsRetry:
5361 ea_response_data = (struct fealist *) 5361 ea_response_data = (struct fealist *)
5362 (((char *) &pSMBr->hdr.Protocol) + data_offset); 5362 (((char *) &pSMBr->hdr.Protocol) + data_offset);
5363 5363
5364 name_len = le32_to_cpu(ea_response_data->list_len); 5364 list_len = le32_to_cpu(ea_response_data->list_len);
5365 cFYI(1, ("ea length %d", name_len)); 5365 cFYI(1, ("ea length %d", list_len));
5366 if (name_len <= 8) { 5366 if (list_len <= 8) {
5367 cFYI(1, ("empty EA list returned from server")); 5367 cFYI(1, ("empty EA list returned from server"));
5368 goto QAllEAsOut; 5368 goto QAllEAsOut;
5369 } 5369 }
5370 5370
5371 /* account for ea list len */ 5371 /* account for ea list len */
5372 name_len -= 4; 5372 list_len -= 4;
5373 temp_fea = ea_response_data->list; 5373 temp_fea = ea_response_data->list;
5374 temp_ptr = (char *)temp_fea; 5374 temp_ptr = (char *)temp_fea;
5375 while (name_len > 0) { 5375 while (list_len > 0) {
5376 __u16 value_len; 5376 __u16 value_len;
5377 name_len -= 4; 5377 list_len -= 4;
5378 temp_ptr += 4; 5378 temp_ptr += 4;
5379 rc += temp_fea->name_len; 5379 rc += temp_fea->name_len;
5380 /* account for prefix user. and trailing null */ 5380 /* account for prefix user. and trailing null */
5381 rc = rc + 5 + 1; 5381 rc = rc + 5 + 1;
5382 if (rc < (int) buf_size) { 5382 if (rc < (int) buf_size) {
5383 memcpy(EAData, "user.", 5); 5383 memcpy(EAData, "user.", 5);
@@ -5386,7 +5386,7 @@ QAllEAsRetry:
5386 EAData += temp_fea->name_len; 5386 EAData += temp_fea->name_len;
5387 /* null terminate name */ 5387 /* null terminate name */
5388 *EAData = 0; 5388 *EAData = 0;
5389 EAData = EAData + 1; 5389 ++EAData;
5390 } else if (buf_size == 0) { 5390 } else if (buf_size == 0) {
5391 /* skip copy - calc size only */ 5391 /* skip copy - calc size only */
5392 } else { 5392 } else {
@@ -5394,13 +5394,13 @@ QAllEAsRetry:
5394 rc = -ERANGE; 5394 rc = -ERANGE;
5395 break; 5395 break;
5396 } 5396 }
5397 name_len -= temp_fea->name_len; 5397 list_len -= temp_fea->name_len;
5398 temp_ptr += temp_fea->name_len; 5398 temp_ptr += temp_fea->name_len;
5399 /* account for trailing null */ 5399 /* account for trailing null */
5400 name_len--; 5400 list_len--;
5401 temp_ptr++; 5401 temp_ptr++;
5402 value_len = le16_to_cpu(temp_fea->value_len); 5402 value_len = le16_to_cpu(temp_fea->value_len);
5403 name_len -= value_len; 5403 list_len -= value_len;
5404 temp_ptr += value_len; 5404 temp_ptr += value_len;
5405 /* BB check that temp_ptr is still 5405 /* BB check that temp_ptr is still
5406 within the SMB BB*/ 5406 within the SMB BB*/