Commit 97bf7b1a authored by Alexander Viro's avatar Alexander Viro Committed by Linus Torvalds

[PATCH] CIFSSMBQueryReparseLinkInfo() endianness fix

le16_to_cpu() on 32bit field.
Signed-off-by: default avatarAl Viro <viro@parcelfarce.linux.org.uk>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent dfbf0ccd
......@@ -1508,16 +1508,16 @@ CIFSSMBQueryReparseLinkInfo(const int xid, struct cifsTconInfo *tcon,
if (rc) {
cFYI(1, ("Send error in QueryReparseLinkInfo = %d", rc));
} else { /* decode response */
pSMBr->DataOffset = le16_to_cpu(pSMBr->DataOffset);
pSMBr->DataCount = le16_to_cpu(pSMBr->DataCount);
if ((pSMBr->ByteCount < 2) || (pSMBr->DataOffset > 512))
__u32 data_offset = le32_to_cpu(pSMBr->DataOffset);
__u32 data_count = le32_to_cpu(pSMBr->DataCount);
if ((pSMBr->ByteCount < 2) || (data_offset > 512))
/* BB also check enough total bytes returned */
rc = -EIO; /* bad smb */
else {
if(pSMBr->DataCount && (pSMBr->DataCount < 2048)) {
if(data_count && (data_count < 2048)) {
/* could also validate reparse tag && better check name length */
struct reparse_data * reparse_buf = (struct reparse_data *)
((char *)&pSMBr->hdr.Protocol + pSMBr->DataOffset);
((char *)&pSMBr->hdr.Protocol + data_offset);
if (pSMBr->hdr.Flags2 & SMBFLG2_UNICODE) {
name_len = UniStrnlen((wchar_t *)
(reparse_buf->LinkNamesBuf +
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment