]> www.infradead.org Git - users/dwmw2/linux.git/commit
cifs: Validate content of NFS reparse point buffer
authorPali Rohár <pali@kernel.org>
Sat, 28 Sep 2024 21:59:47 +0000 (23:59 +0200)
committerSteve French <stfrench@microsoft.com>
Thu, 3 Oct 2024 17:06:13 +0000 (12:06 -0500)
commit556ac52bb1e76cc28fd30aa117b42989965b3efd
tree6938e136aa7ea34a67e117e46388d5cb751535c4
parente2a8910af01653c1c268984855629d71fb81f404
cifs: Validate content of NFS reparse point buffer

Symlink target location stored in DataBuffer is encoded in UTF-16. So check
that symlink DataBuffer length is non-zero and even number. And check that
DataBuffer does not contain UTF-16 null codepoint because Linux cannot
process symlink with null byte.

DataBuffer for char and block devices is 8 bytes long as it contains two
32-bit numbers (major and minor). Add check for this.

DataBuffer buffer for sockets and fifos zero-length. Add checks for this.

Signed-off-by: Pali Rohár <pali@kernel.org>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/smb/client/reparse.c