github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-23 22:52:19 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

cifs: Validate content of native symlink

Browse Source 
Check that path buffer has correct length (it is non-zero and in UNICODE
mode it has even number of bytes) and check that buffer does not contain
null character (UTF-16 null codepoint in UNICODE mode or null byte in
non-unicode mode) because Linux cannot process symlink with null byte.

Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
This commit is contained in:
Pali Rohár 2024-09-23 22:56:46 +02:00 committed by Steve French
parent 723f4ef904
commit dd26bc067e
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
fs/smb/client/reparse.c
View File

@ -547,6 +547,25 @@ int smb2_parse_native_symlink(char **target, const char *buf, unsigned int len,
int rc;
int i;
/* Check that length it valid for unicode/non-unicode mode */
if (!len || (unicode && (len % 2))) {
cifs_dbg(VFS, "srv returned malformed symlink buffer\n");
rc = -EIO;
goto out;
}
/*
* Check that buffer does not contain UTF-16 null codepoint in unicode
* mode or null byte in non-unicode mode because Linux cannot process
* symlink with null byte.
*/
if ((unicode && UniStrnlen((wchar_t *)buf, len/2) != len/2) ||
(!unicode && strnlen(buf, len) != len)) {
cifs_dbg(VFS, "srv returned null byte in native symlink target location\n");
rc = -EIO;
goto out;
}
smb_target = cifs_strndup_from_utf16(buf, len, unicode, cifs_sb->local_nls);
if (!smb_target) {
rc = -ENOMEM;