David Disseldorp 5105a7ffce cifs: fix negotiate context parsing
smb311_decode_neg_context() doesn't properly check against SMB packet
boundaries prior to accessing individual negotiate context entries. This
is due to the length check omitting the eight byte smb2_neg_context
header, as well as incorrect decrementing of len_of_ctxts.

Fixes: 5100d8a3fe03 ("SMB311: Improve checking of negotiate security contexts")
Reported-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Signed-off-by: David Disseldorp <ddiss@suse.de>
Signed-off-by: Steve French <stfrench@microsoft.com>
2023-04-15 18:26:56 -05:00
..
2023-02-20 17:25:43 -06:00
2023-04-15 18:26:56 -05:00
2019-01-24 09:37:33 -06:00
2021-04-25 16:28:23 -05:00
2023-01-19 09:24:28 +01:00