sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-08-24 21:49:29 +03:00
Code Activity

s3: smbd: Add correct wrap checks to smb_set_posix_acl().

Browse Source 
Use unsigned for wrap checks.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
This commit is contained in:
Jeremy Allison
2019-06-21 09:25:42 -07:00
parent 419debdf65
commit 0adbbb8e54
1 changed files with 35 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
source3/smbd/trans2.c
View File

@ -7200,7 +7200,7 @@ static NTSTATUS smb_file_rename_information(connection_struct *conn,
static NTSTATUS smb_set_posix_acl(connection_struct *conn,
struct smb_request *req,
const char *pdata,
int total_data,
int total_data_in,
files_struct *fsp,
const struct smb_filename *smb_fname)
{
@ -7210,6 +7210,15 @@ static NTSTATUS smb_set_posix_acl(connection_struct *conn,
bool valid_file_acls = true;
bool valid_def_acls = true;
NTSTATUS status;
unsigned int size_needed;
unsigned int total_data;
if (total_data_in < 0) {
status = NT_STATUS_INVALID_PARAMETER;
goto out;
}
total_data = total_data_in;
if (total_data < SMB_POSIX_ACL_HEADER_SIZE) {
status = NT_STATUS_INVALID_PARAMETER;
@ -7234,8 +7243,31 @@ static NTSTATUS smb_set_posix_acl(connection_struct *conn,
goto out;
}
if (total_data < SMB_POSIX_ACL_HEADER_SIZE +
(num_file_acls+num_def_acls)*SMB_POSIX_ACL_ENTRY_SIZE) {
/* Wrap checks. */
if (num_file_acls + num_def_acls < num_file_acls) {
status = NT_STATUS_INVALID_PARAMETER;
goto out;
}
size_needed = num_file_acls + num_def_acls;
/*
* (size_needed * SMB_POSIX_ACL_ENTRY_SIZE) must be less
* than UINT_MAX, so check by division.
*/
if (size_needed > (UINT_MAX/SMB_POSIX_ACL_ENTRY_SIZE)) {
status = NT_STATUS_INVALID_PARAMETER;
goto out;
}
size_needed = size_needed*SMB_POSIX_ACL_ENTRY_SIZE;
if (size_needed + SMB_POSIX_ACL_HEADER_SIZE < size_needed) {
status = NT_STATUS_INVALID_PARAMETER;
goto out;
}
size_needed += SMB_POSIX_ACL_HEADER_SIZE;
if (total_data < size_needed) {
status = NT_STATUS_INVALID_PARAMETER;
goto out;
}