iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ksmbd: fix error code in ndr_read_int32()

Browse Source 
This is a failure path and it should return -EINVAL instead of success.
Otherwise it could result in the caller using uninitialized memory.

Fixes: 303fff2b8c ("ksmbd: add validation for ndr read/write functions")
Cc: stable@vger.kernel.org # v5.15
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
This commit is contained in:
Dan Carpenter 2021-11-30 15:50:47 +03:00 committed by Steve French
parent 2585cf9dfa
commit ef399469d9
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fs/ksmbd/ndr.c
View File

@ -148,7 +148,7 @@ static int ndr_read_int16(struct ndr *n, __u16 *value)
static int ndr_read_int32(struct ndr *n, __u32 *value) static int ndr_read_int32(struct ndr *n, __u32 *value)
{ {
if (n->offset + sizeof(__u32) > n->length) if (n->offset + sizeof(__u32) > n->length)
return 0; return -EINVAL;
if (value) if (value)
*value = le32_to_cpu(*(__le32 *)ndr_get_field(n)); *value = le32_to_cpu(*(__le32 *)ndr_get_field(n));