diff options
| author | Jeff Layton <jlayton@redhat.com> | 2011-04-27 13:25:51 -0400 |
|---|---|---|
| committer | Steve French <sfrench@us.ibm.com> | 2011-04-29 04:57:35 +0000 |
| commit | bfacf2225a955bea9c41c707fc72ba16009674a0 (patch) | |
| tree | b164fd09adda6397a46d7a0e2e1438a3b5525d72 /fs | |
| parent | fafc9929c668f8bae6dd1f109f33a86d2cb3c460 (diff) | |
| download | kernel_samsung_smdk4412-bfacf2225a955bea9c41c707fc72ba16009674a0.zip kernel_samsung_smdk4412-bfacf2225a955bea9c41c707fc72ba16009674a0.tar.gz kernel_samsung_smdk4412-bfacf2225a955bea9c41c707fc72ba16009674a0.tar.bz2 | |
cifs: change bleft in decode_unicode_ssetup back to signed type
The buffer length checks in this function depend on this value being a
signed data type, but 690c522fa converted it to an unsigned type.
Also, eliminate a problem with the null termination check in the same
function. cifs_strndup_from_ucs handles that situation correctly
already, and the existing check could potentially lead to a buffer
overrun since it increments bleft without checking to see whether it
falls off the end of the buffer.
Cc: stable@kernel.org
Reported-and-Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/cifs/sess.c | 15 |
1 files changed, 1 insertions, 14 deletions
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c index f6728eb..2e2c911 100644 --- a/fs/cifs/sess.c +++ b/fs/cifs/sess.c @@ -276,7 +276,7 @@ static void ascii_ssetup_strings(char **pbcc_area, struct cifsSesInfo *ses, } static void -decode_unicode_ssetup(char **pbcc_area, __u16 bleft, struct cifsSesInfo *ses, +decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifsSesInfo *ses, const struct nls_table *nls_cp) { int len; @@ -284,19 +284,6 @@ decode_unicode_ssetup(char **pbcc_area, __u16 bleft, struct cifsSesInfo *ses, cFYI(1, "bleft %d", bleft); - /* - * Windows servers do not always double null terminate their final - * Unicode string. Check to see if there are an uneven number of bytes - * left. If so, then add an extra NULL pad byte to the end of the - * response. - * - * See section 2.7.2 in "Implementing CIFS" for details - */ - if (bleft % 2) { - data[bleft] = 0; - ++bleft; - } - kfree(ses->serverOS); ses->serverOS = cifs_strndup_from_ucs(data, bleft, true, nls_cp); cFYI(1, "serverOS=%s", ses->serverOS); |