Re: [PATCH] smb: client: fix OOB pointer arithmetic in cifs_to_posix_acl()

On Tue, Aug 25, 2026 at 8:10 AM Frank Sorenson <[email protected]> wrote:
>
> In the ACL_TYPE_DEFAULT branch, cifs_to_posix_acl() forms a pointer
> from the server-supplied access_entry_count before the size check that
> bounds it:
There seems to be still oob issue in this function although this patch
is applied.
Should we also validate acl header before accessing ->version ?

+        if (size_of_data_area < sizeof(*cifs_acl))
+              return -EINVAL;

        if (le16_to_cpu(cifs_acl->version) != CIFS_ACL_VERSION)
                return -EOPNOTSUPP;
>
>         pACE = &cifs_acl->ace_array[count];     /* count = access_entry_count */
>         count = le16_to_cpu(cifs_acl->default_entry_count);
>         size += sizeof(struct cifs_posix_ace) * count;
>         if (size_of_data_area < size)           /* too late */
>                 return -EINVAL;
>
> The pointer arithmetic is undefined behaviour before any bounds check.
>
> Add an access-ACE size check before the pointer computation, matching
> the existing guard in the ACL_TYPE_ACCESS path.