]> Gentwo Git Trees - linux/.git/commit
cifs: parse_dfs_referrals: prevent oob on malformed input
authorEugene Korenevsky <ekorenevsky@aliyun.com>
Mon, 13 Oct 2025 18:39:30 +0000 (21:39 +0300)
committerSteve French <stfrench@microsoft.com>
Thu, 16 Oct 2025 03:10:28 +0000 (22:10 -0500)
commit6447b0e355562a1ff748c4a2ffb89aae7e84d2c9
tree3116023e821cff099b4c699a4325b02dfbd19b80
parentc2b77f42205ef485a647f62082c442c1cd69d3fc
cifs: parse_dfs_referrals: prevent oob on malformed input

Malicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS

- reply smaller than sizeof(struct get_dfs_referral_rsp)
- reply with number of referrals smaller than NumberOfReferrals in the
header

Processing of such replies will cause oob.

Return -EINVAL error on such replies to prevent oob-s.

Signed-off-by: Eugene Korenevsky <ekorenevsky@aliyun.com>
Cc: stable@vger.kernel.org
Suggested-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/smb/client/misc.c