Attachment 24025 Details for Bug 61204

[patch] Patch from Urban Widmark via Stefan Esser via vendor-sec

linux-2.4.27-smb.diff (text/plain), 2.64 KB, created by Sebastian Krahmer on 2004-09-27 20:22:26 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Sebastian Krahmer

Created: 2004-09-27 20:22:26 UTC

Size: 2.64 KB

patch

obsolete

>
>diff -urN -X exclude linux-2.4.27-orig/MAINTAINERS linux-2.4.27-smbfs/MAINTAINERS
>--- linux-2.4.27-orig/MAINTAINERS       2004-08-08 01:26:04.000000000 +0200
>+++ linux-2.4.27-smbfs/MAINTAINERS      2004-09-26 20:48:59.000000000 +0200
>@@ -1689,10 +1689,8 @@
>
> SMB FILESYSTEM
> P:     Urban Widmark
>-M:     urban@teststation.com
>-W:     http://samba.org/
>-L:     samba@samba.org
>-S:     Maintained
>+M:     Urban.Widmark@enlight.net
>+S:     Odd Fixes
>
> SNA NETWORK LAYER
> P:     Jay Schulist
>diff -urN -X exclude linux-2.4.27-orig/fs/smbfs/proc.c linux-2.4.27-smbfs/fs/smbfs/proc.c
>--- linux-2.4.27-orig/fs/smbfs/proc.c   2004-04-14 15:05:40.000000000 +0200
>+++ linux-2.4.27-smbfs/fs/smbfs/proc.c  2004-09-26 21:04:21.659420633 +0200
>@@ -1289,9 +1289,11 @@
>        data_len = WVAL(buf, 1);
>
>        /* we can NOT simply trust the data_len given by the server ... */
>-       if (data_len > server->packet_size - (buf+3 - server->packet)) {
>+       if (data_len > count ||
>+           data_len > server->packet_size - (buf+3 - server->packet)) {
>                printk(KERN_ERR "smb_proc_read: invalid data length!! "
>-                      "%d > %d - (%p - %p)\n",
>+                      "%d > %d || %d > %d - (%p - %p)\n",
>+                      data_len, count,
>                       data_len, server->packet_size, buf+3, server->packet);
>                result = -EIO;
>                goto out;
>@@ -1378,9 +1380,11 @@
>        buf = smb_base(server->packet) + data_off;
>
>        /* we can NOT simply trust the info given by the server ... */
>-       if (data_len > server->packet_size - (buf - server->packet)) {
>+       if (data_len > count ||
>+           data_len > server->packet_size - (buf - server->packet)) {
>                printk(KERN_ERR "smb_proc_read: invalid data length!! "
>-                      "%d > %d - (%p - %p)\n",
>+                      "%d > %d || %d > %d - (%p - %p)\n",
>+                      data_len, count,
>                       data_len, server->packet_size, buf, server->packet);
>                result = -EIO;
>                goto out;
>diff -urN -X exclude linux-2.4.27-orig/fs/smbfs/sock.c linux-2.4.27-smbfs/fs/smbfs/sock.c
>--- linux-2.4.27-orig/fs/smbfs/sock.c   2002-11-29 00:53:15.000000000 +0100
>+++ linux-2.4.27-smbfs/fs/smbfs/sock.c  2004-09-26 20:42:36.000000000 +0200
>@@ -625,6 +625,9 @@
>                server->packet = rcv_buf;
>                rcv_buf = inbuf;
>        } else {
>+               if (parm_len + data_len > buf_len)
>+                       goto out_data_grew;
>+
>                PARANOIA("copying data, old size=%d, new size=%u\n",
>                         server->packet_size, buf_len);
>                memcpy(inbuf, rcv_buf, parm_len + data_len);
>

Actions: View | Diff

Attachments on bug 61204: 24025 | 24687 | 25202 | 25459 | 25460 | 27379 | 27397 | 27398 | 27616 | 27619