Commit 91d065c4 authored by Jeff Layton's avatar Jeff Layton Committed by Steve French

cifs: fix name parsing in CIFSSMBQAllEAs

The code that matches EA names in CIFSSMBQAllEAs is incorrect. It
uses strncmp to do the comparison with the length limited to the
name_len sent in the response.

Problem: Suppose we're looking for an attribute named "foobar" and
have an attribute before it in the EA list named "foo". The
comparison will succeed since we're only looking at the first 3
characters. Fix this by also comparing the length of the provided
ea_name with the name_len in the response. If they're not equal then
it shouldn't match.
Reported-by: default avatarJian Li <jiali@redhat.com>
Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
Reviewed-by: default avatarPavel Shilovsky <piastryyy@gmail.com>
Signed-off-by: default avatarSteve French <sfrench@us.ibm.com>
parent 998d6fcb
......@@ -5720,6 +5720,7 @@ CIFSSMBQAllEAs(const int xid, struct cifs_tcon *tcon,
char *temp_ptr;
char *end_of_smb;
__u16 params, byte_count, data_offset;
unsigned int ea_name_len;
cFYI(1, "In Query All EAs path %s", searchName);
QAllEAsRetry:
......@@ -5814,6 +5815,10 @@ CIFSSMBQAllEAs(const int xid, struct cifs_tcon *tcon,
list_len -= 4;
temp_fea = ea_response_data->list;
temp_ptr = (char *)temp_fea;
if (ea_name)
ea_name_len = strlen(ea_name);
while (list_len > 0) {
unsigned int name_len;
__u16 value_len;
......@@ -5837,7 +5842,8 @@ CIFSSMBQAllEAs(const int xid, struct cifs_tcon *tcon,
}
if (ea_name) {
if (strncmp(ea_name, temp_ptr, name_len) == 0) {
if (ea_name_len == name_len &&
strncmp(ea_name, temp_ptr, name_len) == 0) {
temp_ptr += name_len + 1;
rc = value_len;
if (buf_size == 0)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment