[PATCH] smb: client: fix OOB array access in __smb2_calc_size() on unknown Command
Frank Sorenson <[email protected]>
| Newsgroups | org.kernel.vger.linux-cifs,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
has_smb2_data_area[] is indexed by the server-supplied shdr->Command
with no bounds check:
if (has_smb2_data_area[le16_to_cpu(shdr->Command)] == false)
The array has NUMBER_OF_SMB2_COMMANDS (0x13) entries; any Command value
>= 0x13 reads past the end into adjacent read-only data.
Add an upper-bound check before the lookup; commands outside the valid
range have no data area, so treat them as false.
Fixes: 093b2bdad322 ("CIFS: Make demultiplex_thread work with SMB2 code")
Cc: [email protected]
Signed-off-by: Frank Sorenson <[email protected]>
---
fs/smb/client/smb2misc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/smb/client/smb2misc.c b/fs/smb/client/smb2misc.c
index 9068175e57cd..26b41ea3b72b 100644
--- a/fs/smb/client/smb2misc.c
+++ b/fs/smb/client/smb2misc.c
@@ -451,7 +451,8 @@ __smb2_calc_size(void *buf, bool *have_data, bool *data_area_overlap)
*/
len += le16_to_cpu(pdu->StructureSize2);
- if (has_smb2_data_area[le16_to_cpu(shdr->Command)] == false)
+ if (le16_to_cpu(shdr->Command) >= ARRAY_SIZE(has_smb2_data_area) ||
+ !has_smb2_data_area[le16_to_cpu(shdr->Command)])
goto calc_size_exit;
smb2_get_data_area_len(&offset, &data_length, shdr);
--
2.55.0