diff options
| author | Pali Rohár <pali@kernel.org> | 2024-09-23 22:56:46 +0200 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2024-11-25 14:50:32 -0600 |
| commit | dd26bc067e44956e43a273e6e0a9c1fc4ed32cb7 (patch) | |
| tree | b71c863a5aa52892badd2ba4b318db6a899525af /fs | |
| parent | 723f4ef90452aa629f3d923e92e0449d69362b1d (diff) | |
cifs: Validate content of native symlink
Check that path buffer has correct length (it is non-zero and in UNICODE
mode it has even number of bytes) and check that buffer does not contain
null character (UTF-16 null codepoint in UNICODE mode or null byte in
non-unicode mode) because Linux cannot process symlink with null byte.
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/smb/client/reparse.c | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/fs/smb/client/reparse.c b/fs/smb/client/reparse.c index f74d0a86f44a..f563fd332a1b 100644 --- a/fs/smb/client/reparse.c +++ b/fs/smb/client/reparse.c @@ -547,6 +547,25 @@ int smb2_parse_native_symlink(char **target, const char *buf, unsigned int len, int rc; int i; + /* Check that length it valid for unicode/non-unicode mode */ + if (!len || (unicode && (len % 2))) { + cifs_dbg(VFS, "srv returned malformed symlink buffer\n"); + rc = -EIO; + goto out; + } + + /* + * Check that buffer does not contain UTF-16 null codepoint in unicode + * mode or null byte in non-unicode mode because Linux cannot process + * symlink with null byte. + */ + if ((unicode && UniStrnlen((wchar_t *)buf, len/2) != len/2) || + (!unicode && strnlen(buf, len) != len)) { + cifs_dbg(VFS, "srv returned null byte in native symlink target location\n"); + rc = -EIO; + goto out; + } + smb_target = cifs_strndup_from_utf16(buf, len, unicode, cifs_sb->local_nls); if (!smb_target) { rc = -ENOMEM; |