diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2023-07-22 00:09:28 +0900 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2023-07-23 10:25:11 -0500 |
| commit | dc318846f3dd54574a36ae97fc8d8b75dd7cdb1e (patch) | |
| tree | 51911dfc6dcbb84618fa244eef4cea34df7ba986 /fs | |
| parent | 2b57a4322b1b14348940744fdc02f9a86cbbdbeb (diff) | |
ksmbd: fix out of bounds in smb3_decrypt_req()
smb3_decrypt_req() validate if pdu_length is smaller than
smb2_transform_hdr size.
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21589
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/smb/server/smb2pdu.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index ca276634fd58..3eb5d4d891f2 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -8614,7 +8614,8 @@ int smb3_decrypt_req(struct ksmbd_work *work) struct smb2_transform_hdr *tr_hdr = smb2_get_msg(buf); int rc = 0; - if (buf_data_size < sizeof(struct smb2_hdr)) { + if (pdu_length < sizeof(struct smb2_transform_hdr) || + buf_data_size < sizeof(struct smb2_hdr)) { pr_err("Transform message is too small (%u)\n", pdu_length); return -ECONNABORTED; |