Attachment 24687 Details for Bug 61204

[patch] smbfs for 2.4 patch

xx.pat (text/plain), 2.09 KB, created by Marcus Meissner on 2004-10-06 23:10:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcus Meissner

Created: 2004-10-06 23:10:36 UTC

Size: 2.09 KB

patch

obsolete

>--- linux-2.4.21/fs/smbfs/proc.c.orig	2004-10-06 16:18:38.000000000 +0200
>+++ linux-2.4.21/fs/smbfs/proc.c	2004-10-06 17:04:35.011342638 +0200
>@@ -1333,9 +1333,11 @@
> 	data_len = WVAL(buf, 1);
> 
> 	/* we can NOT simply trust the data_len given by the server ... */
>-	if (data_len > server->packet_size - (buf+3 - server->packet)) {
>+       if (data_len > count ||
>+           data_len > server->packet_size - (buf+3 - server->packet)) {
> 		printk(KERN_ERR "smb_proc_read: invalid data length!! "
>-		       "%d > %d - (%p - %p)\n",
>+                      "%d > %d || %d > %d - (%p - %p)\n",
>+                      data_len, count,
> 		       data_len, server->packet_size, buf+3, server->packet);
> 		result = -EIO;
> 		goto out;
>@@ -1422,9 +1424,11 @@
> 	buf = smb_base(server->packet) + data_off;
> 
> 	/* we can NOT simply trust the info given by the server ... */
>-	if (data_len > server->packet_size - (buf - server->packet)) {
>+       if (data_len > count ||
>+           data_len > server->packet_size - (buf - server->packet)) {
> 		printk(KERN_ERR "smb_proc_read: invalid data length!! "
>-		       "%d > %d - (%p - %p)\n",
>+                      "%d > %d || %d > %d - (%p - %p)\n",
>+                      data_len, count,
> 		       data_len, server->packet_size, buf, server->packet);
> 		result = -EIO;
> 		goto out;
>--- linux-2.4.21/fs/smbfs/sock.c.orig	2004-10-06 16:18:29.000000000 +0200
>+++ linux-2.4.21/fs/smbfs/sock.c	2004-10-06 17:04:35.012342423 +0200
>@@ -625,6 +625,9 @@
> 		server->packet = rcv_buf;
> 		rcv_buf = inbuf;
> 	} else {
>+               if (parm_len + data_len > buf_len)
>+                       goto out_data_grew;
>+
> 		PARANOIA("copying data, old size=%d, new size=%u\n",
> 			 server->packet_size, buf_len);
> 		memcpy(inbuf, rcv_buf, parm_len + data_len);
>--- linux-2.4.21/MAINTAINERS.orig	2004-10-06 16:18:54.000000000 +0200
>+++ linux-2.4.21/MAINTAINERS	2004-10-06 17:04:35.007343497 +0200
>@@ -1665,10 +1665,8 @@
> 
> SMB FILESYSTEM
> P:	Urban Widmark
>-M:	urban@teststation.com
>-W:	http://samba.org/
>-L:	samba@samba.org
>-S:	Maintained
>+M:     Urban.Widmark@enlight.net
>+S:     Odd Fixes
> 
> SNA NETWORK LAYER
> P:	Jay Schulist

Actions: View | Diff

Attachments on bug 61204: 24025 | 24687 | 25202 | 25459 | 25460 | 27379 | 27397 | 27398 | 27616 | 27619