cifs: parse_dfs_referrals: prevent oob on malformed input
Malicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS - reply smaller than sizeof(struct get_dfs_referral_rsp) - reply with number of referrals smaller than NumberOfReferrals in the header Processing of such replies will cause oob. Return -EINVAL error on such replies to prevent oob-s. Signed-off-by:Eugene Korenevsky <ekorenevsky@aliyun.com> Cc: stable@vger.kernel.org Suggested-by:
Nathan Chancellor <nathan@kernel.org> Acked-by:
Paulo Alcantara (Red Hat) <pc@manguebit.org> Signed-off-by:
Steve French <stfrench@microsoft.com>
Loading
Please sign in to comment