Skip to content

Commit 64c4a37

Browse files
harshimogalapalliSteve French
authored andcommitted
cifs: potential buffer overflow in handling symlinks
Smatch printed a warning: arch/x86/crypto/poly1305_glue.c:198 poly1305_update_arch() error: __memcpy() 'dctx->buf' too small (16 vs u32max) It's caused because Smatch marks 'link_len' as untrusted since it comes from sscanf(). Add a check to ensure that 'link_len' is not larger than the size of the 'link_str' buffer. Fixes: c69c1b6 ("cifs: implement CIFSParseMFSymlink()") Signed-off-by: Harshit Mogalapalli <[email protected]> Reviewed-by: Ronnie Sahlberg <[email protected]> Signed-off-by: Steve French <[email protected]>
1 parent 1ddff77 commit 64c4a37

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

fs/cifs/link.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,9 @@ parse_mf_symlink(const u8 *buf, unsigned int buf_len, unsigned int *_link_len,
8585
if (rc != 1)
8686
return -EINVAL;
8787

88+
if (link_len > CIFS_MF_SYMLINK_LINK_MAXLEN)
89+
return -EINVAL;
90+
8891
rc = symlink_hash(link_len, link_str, md5_hash);
8992
if (rc) {
9093
cifs_dbg(FYI, "%s: MD5 hash failure: %d\n", __func__, rc);

0 commit comments

Comments
 (0)