Commit 1fc29bac authored by Jeff Layton's avatar Jeff Layton Committed by Steve French

cifs: fix off-by-one bug in build_unc_path_to_root

commit 839db3d1 (cifs: fix up handling of prefixpath= option) changed
the code such that the vol->prepath no longer contained a leading
delimiter and then fixed up the places that accessed that field to
account for that change.

One spot in build_unc_path_to_root was missed however. When doing the
pointer addition on pos, that patch failed to account for the fact that
we had already incremented "pos" by one when adding the length of the
prepath. This caused a buffer overrun by one byte.

This patch fixes the problem by correcting the handling of "pos".

Cc: <stable@vger.kernel.org> # v3.8+
Reported-by: default avatarMarcus Moeller <marcus.moeller@gmx.ch>
Reported-by: default avatarKen Fallon <ken.fallon@gmail.com>
Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
Signed-off-by: default avatarSteve French <sfrench@us.ibm.com>
parent a93cb29a
...@@ -3279,8 +3279,8 @@ build_unc_path_to_root(const struct smb_vol *vol, ...@@ -3279,8 +3279,8 @@ build_unc_path_to_root(const struct smb_vol *vol,
pos = full_path + unc_len; pos = full_path + unc_len;
if (pplen) { if (pplen) {
*pos++ = CIFS_DIR_SEP(cifs_sb); *pos = CIFS_DIR_SEP(cifs_sb);
strncpy(pos, vol->prepath, pplen); strncpy(pos + 1, vol->prepath, pplen);
pos += pplen; pos += pplen;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment