smb_strdupin() tried to roll a copyin() based strlen to allocate a buffer and then blindly copyin that size. Of course, a malicious user program could simultaneously manipulate the buffer, resulting in a non-terminated string being copied. Later assumptions in the code rely upon the string being nul-terminated. Just use copyinstr() and drop the racy sizing. PR: 222687 Reported by: Meng Xu <meng.xu AT gatech.edu> Security: possible local DoS Sponsored by: Dell EMC Isilon |
||
---|---|---|
.. | ||
netbios.h | ||
smb_conn.c | ||
smb_conn.h | ||
smb_crypt.c | ||
smb_dev.c | ||
smb_dev.h | ||
smb_iod.c | ||
smb_rq.c | ||
smb_rq.h | ||
smb_smb.c | ||
smb_subr.c | ||
smb_subr.h | ||
smb_tran.h | ||
smb_trantcp.c | ||
smb_trantcp.h | ||
smb_usr.c | ||
smb.h |