Attachment 25202 Details for Bug 61204

[patch] mail from stefan esser

smbfs (text/plain), 2.08 KB, created by Ludwig Nussel on 2004-10-20 16:09:42 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ludwig Nussel

Created: 2004-10-20 16:09:42 UTC

Size: 2.08 KB

patch

obsolete

>Hello,
>
>i do not remember if I have already sent the patch for 2.6 fixing the
>"possible" kernel memory content leak through CIFS fragment rebuilding.
>(this patch is from urban widmark)
>
>Stefan
>
>ps: I think linus is getting nervous because he already wanted to release
>2.6.9 without the patch yesterday...
>
>diff -urN -X exclude linux-2.6.8-orig/fs/smbfs/request.c linux-2.6.8-smbfs/fs/smbfs/request.c
>--- linux-2.6.8-orig/fs/smbfs/request.c 2004-10-01 17:44:43.361166440 +0200
>+++ linux-2.6.8-smbfs/fs/smbfs/request.c        2004-10-01 18:32:23.304686863 +0200
>@@ -634,6 +634,7 @@
>                req->rq_trans2buffer = smb_kmalloc(buf_len, GFP_NOFS);
>                if (!req->rq_trans2buffer)
>                        goto out_no_mem;
>+               memset(req->rq_trans2buffer, 0, buf_len);
>
>                req->rq_parm = req->rq_trans2buffer;
>                req->rq_data = req->rq_trans2buffer + parm_tot;
>@@ -657,8 +658,11 @@
>         * Check whether we've received all of the data. Note that
>         * we use the packet totals -- total lengths might shrink!
>         */
>-       if (req->rq_ldata >= data_tot && req->rq_lparm >= parm_tot)
>+       if (req->rq_ldata >= data_tot && req->rq_lparm >= parm_tot) {
>+               req->rq_ldata = data_tot;
>+               req->rq_lparm = parm_tot;
>                return 0;
>+       }
>        return 1;
>
> out_too_long:
>
>
>
>
>-- 
>
>--------------------------------------------------------------------------
> Stefan Esser                                        s.esser@e-matters.de
> e-matters Security                         http://security.e-matters.de/
>
> GPG-Key                gpg --keyserver pgp.mit.edu --recv-key 0x15ABDA78 
> Key fingerprint       7806 58C8 CFA8 CE4A 1C2C  57DD 4AE1 795E 15AB DA78
>--------------------------------------------------------------------------
> Did I help you? Consider a gift:            http://wishlist.suspekt.org/
>--------------------------------------------------------------------------
>
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec

Actions: View | Diff

Attachments on bug 61204: 24025 | 24687 | 25202 | 25459 | 25460 | 27379 | 27397 | 27398 | 27616 | 27619