Skip to content

Commit

Permalink
[CIFS] Maximum username length check in session setup does not match
Browse files Browse the repository at this point in the history
Fix length check reported by D. Binderman (see below)

d binderman <[email protected]> wrote:
>
> I just ran the sourceforge tool cppcheck over the source code of the
> new Linux kernel 2.6.33-rc6
>
> It said
>
> [./cifs/sess.c:250]: (error) Buffer access out-of-bounds

May turn out to be harmless, but best to be safe. Note max
username length is defined to 32 due to Linux (Windows
maximum is 20).

Signed-off-by: Steve French <[email protected]>
  • Loading branch information
Steve French committed Feb 6, 2010
1 parent f12f98d commit 301a6a3
Showing 1 changed file with 5 additions and 6 deletions.
11 changes: 5 additions & 6 deletions fs/cifs/sess.c
Original file line number Diff line number Diff line change
Expand Up @@ -223,9 +223,9 @@ static void unicode_ssetup_strings(char **pbcc_area, struct cifsSesInfo *ses,
/* null user mount */
*bcc_ptr = 0;
*(bcc_ptr+1) = 0;
} else { /* 300 should be long enough for any conceivable user name */
} else {
bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->userName,
300, nls_cp);
MAX_USERNAME_SIZE, nls_cp);
}
bcc_ptr += 2 * bytes_ret;
bcc_ptr += 2; /* account for null termination */
Expand All @@ -246,11 +246,10 @@ static void ascii_ssetup_strings(char **pbcc_area, struct cifsSesInfo *ses,
/* copy user */
if (ses->userName == NULL) {
/* BB what about null user mounts - check that we do this BB */
} else { /* 300 should be long enough for any conceivable user name */
strncpy(bcc_ptr, ses->userName, 300);
} else {
strncpy(bcc_ptr, ses->userName, MAX_USERNAME_SIZE);
}
/* BB improve check for overflow */
bcc_ptr += strnlen(ses->userName, 300);
bcc_ptr += strnlen(ses->userName, MAX_USERNAME_SIZE);
*bcc_ptr = 0;
bcc_ptr++; /* account for null termination */

Expand Down

0 comments on commit 301a6a3

Please sign in to comment.