Commit dfbf0ccd authored by Alexander Viro's avatar Alexander Viro Committed by Linus Torvalds

[PATCH] CIFSSMBNegotiate endianness fix

Use of 16bit little-endian in comparisons and arithmetics without
conversion. 
Signed-off-by: default avatarAl Viro <viro@parcelfarce.linux.org.uk>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent fad8db49
...@@ -236,9 +236,10 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses) ...@@ -236,9 +236,10 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
if ((pSMBr->hdr.Flags2 & SMBFLG2_EXT_SEC) && if ((pSMBr->hdr.Flags2 & SMBFLG2_EXT_SEC) &&
(server->capabilities & CAP_EXTENDED_SECURITY)) { (server->capabilities & CAP_EXTENDED_SECURITY)) {
if (pSMBr->ByteCount < 16) __u16 count = le16_to_cpu(pSMBr->ByteCount);
if (count < 16)
rc = -EIO; rc = -EIO;
else if (pSMBr->ByteCount == 16) { else if (count == 16) {
server->secType = RawNTLMSSP; server->secType = RawNTLMSSP;
if (server->socketUseCount.counter > 1) { if (server->socketUseCount.counter > 1) {
if (memcmp if (memcmp
...@@ -261,8 +262,8 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses) ...@@ -261,8 +262,8 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
rc = decode_negTokenInit(pSMBr->u. rc = decode_negTokenInit(pSMBr->u.
extended_response. extended_response.
SecurityBlob, SecurityBlob,
pSMBr->ByteCount - count - 16,
16, &server->secType); &server->secType);
} }
} else } else
server->capabilities &= ~CAP_EXTENDED_SECURITY; server->capabilities &= ~CAP_EXTENDED_SECURITY;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment