linux-cifs.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] CIFS: Fix a potencially linear read overflow
@ 2021-08-17 10:27 Len Baker
  2021-08-18  0:28 ` Paulo Alcantara
  2021-08-18 13:21 ` Jeff Layton
  0 siblings, 2 replies; 5+ messages in thread
From: Len Baker @ 2021-08-17 10:27 UTC (permalink / raw)
  To: Steve French, Jeff Layton, Suresh Jayaraman
  Cc: Len Baker, linux-cifs, samba-technical, linux-kernel, Kees Cook,
	linux-hardening

strlcpy() reads the entire source buffer first. This read may exceed the
destination size limit. This is both inefficient and can lead to linear
read overflows if a source string is not NUL-terminated.

Also, the strnlen() call does not avoid the read overflow in the strlcpy
function when a not NUL-terminated string is passed.

So, replace this block by a call to kstrndup() that avoids this type of
overflow and does the same.

Fixes: 066ce6899484d ("cifs: rename cifs_strlcpy_to_host and make it use new functions")
Signed-off-by: Len Baker <len.baker@gmx.com>
---
 fs/cifs/cifs_unicode.c | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index 9bd03a231032..171ad8b42107 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -358,14 +358,9 @@ cifs_strndup_from_utf16(const char *src, const int maxlen,
 		if (!dst)
 			return NULL;
 		cifs_from_utf16(dst, (__le16 *) src, len, maxlen, codepage,
-			       NO_MAP_UNI_RSVD);
+				NO_MAP_UNI_RSVD);
 	} else {
-		len = strnlen(src, maxlen);
-		len++;
-		dst = kmalloc(len, GFP_KERNEL);
-		if (!dst)
-			return NULL;
-		strlcpy(dst, src, len);
+		dst = kstrndup(src, maxlen, GFP_KERNEL);
 	}

 	return dst;
--
2.25.1


^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2021-08-20  5:59 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-08-17 10:27 [PATCH] CIFS: Fix a potencially linear read overflow Len Baker
2021-08-18  0:28 ` Paulo Alcantara
2021-08-18  2:46   ` Steve French
2021-08-18 13:21 ` Jeff Layton
2021-08-20  5:58   ` Steve French

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).