Dan Carpenter 2d204ee9d6 cifs: integer overflow in in SMB2_ioctl()
The "le32_to_cpu(rsp->OutputOffset) + *plen" addition can overflow and
wrap around to a smaller value which looks like it would lead to an
information leak.

Fixes: 4a72dafa19ba ("SMB2 FSCTL and IOCTL worker function")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
CC: Stable <stable@vger.kernel.org>
2018-09-12 09:32:07 -05:00
..
2018-09-06 09:04:45 -07:00
2018-06-11 10:16:13 -07:00
2018-08-21 23:54:17 -04:00
2018-08-22 13:29:39 -07:00
2018-08-21 18:47:36 -07:00
2018-08-15 22:40:03 -07:00
2018-08-17 16:20:28 -07:00
2018-08-15 22:47:23 -07:00
2018-08-18 11:44:53 -07:00
2018-05-22 14:27:52 -04:00
2018-08-23 16:03:58 -07:00
2018-08-17 16:20:27 -07:00
2018-08-21 18:19:09 -07:00
2018-05-22 14:27:52 -04:00
2018-08-18 11:44:53 -07:00
2018-08-24 13:50:07 +02:00
2018-08-21 18:19:09 -07:00
2018-07-03 16:44:45 -04:00
2018-08-14 10:23:25 -07:00
2018-06-05 19:23:26 +02:00
2018-08-25 18:43:59 -07:00
2018-08-21 18:19:09 -07:00
2018-05-03 16:11:37 -06:00
2018-08-21 18:19:09 -07:00
2018-08-21 18:19:09 -07:00
2018-07-18 15:44:40 +02:00
2018-08-21 18:15:47 -07:00
2018-06-11 08:22:34 -07:00
2018-08-21 18:19:09 -07:00
2018-02-15 15:34:42 -05:00
2018-08-21 18:19:09 -07:00
2018-04-04 12:44:02 -07:00