Attachment #27616 for bug #61204

View | Details | Raw Unified | Return to bug 61204
Collapse All | Expand All

Lines 1427-1435 Link Here

(-)linux.vanilla-2.6.10/fs/smbfs/proc.c (-3 / +3 lines)
1427	* So we must first calculate the amount of padding used by the server.	1427	* So we must first calculate the amount of padding used by the server.
1428	*/	1428	*/
1429	data_off -= hdrlen;	1429	data_off -= hdrlen;
1430	if (data_off > SMB_READX_MAX_PAD) {	1430	if (data_off > SMB_READX_MAX_PAD \|\| data_off < 0) {
1431	PARANOIA("offset is larger than max pad!\n");	1431	PARANOIA("offset is larger than SMB_READX_MAX_PAD or negative!\n");
1432	PARANOIA("%d > %d\n", data_off, SMB_READX_MAX_PAD);	1432	PARANOIA("%d > %d \|\| %d < 0\n", data_off, SMB_READX_MAX_PAD, data_off);
1433	req->rq_rlen = req->rq_bufsize + 1;	1433	req->rq_rlen = req->rq_bufsize + 1;
1434	return;	1434	return;
1435	}	1435	}




	data_count  = WVAL(inbuf, smb_drcnt);

	/* Modify offset for the split header/buffer we use */
	if (data_count || data_offset) {
		if (unlikely(data_offset < hdrlen))
			goto out_bad_data;
		else
			data_offset -= hdrlen;
	}
	if (parm_count || parm_offset) {
		if (unlikely(parm_offset < hdrlen))
			goto out_bad_parm;
		else
			parm_offset -= hdrlen;
	}

	if (parm_count == parm_tot && data_count == data_tot) {
		/*

		 * response that fits.
		 */
		VERBOSE("single trans2 response  "
			"dcnt=%u, pcnt=%u, doff=%u, poff=%u\n",
			data_count, parm_count,
			data_offset, parm_offset);
		req->rq_ldata = data_count;
		req->rq_lparm = parm_count;
		req->rq_data = req->rq_buffer + data_offset;
		req->rq_parm = req->rq_buffer + parm_offset;
		if (unlikely(parm_offset + parm_count > req->rq_rlen))
			goto out_bad_parm;
		if (unlikely(data_offset + data_count > req->rq_rlen))
			goto out_bad_data;
		return 0;
	}

	VERBOSE("multi trans2 response  "
		"frag=%d, dcnt=%u, pcnt=%u, doff=%u, poff=%u\n",
		req->rq_fragment,
		data_count, parm_count,
		data_offset, parm_offset);


		req->rq_parm = req->rq_trans2buffer;
		req->rq_data = req->rq_trans2buffer + parm_tot;
	} else if (unlikely(req->rq_total_data < data_tot ||
			    req->rq_total_parm < parm_tot))
		goto out_data_grew;

	if (unlikely(parm_disp + parm_count > req->rq_total_parm ||
		     parm_offset + parm_count > req->rq_rlen))
		goto out_bad_parm;
	if (unlikely(data_disp + data_count > req->rq_total_data ||
		     data_offset + data_count > req->rq_rlen))
		goto out_bad_data;

	inbuf = req->rq_buffer;

	return 1;

out_too_long:
	printk(KERN_ERR "smb_trans2: data/param too long, data=%u, parm=%u\n",
		data_tot, parm_tot);
	goto out_EIO;
	goto out;
out_no_mem:
	printk(KERN_ERR "smb_trans2: couldn't allocate data area of %d bytes\n",
	       req->rq_trans2bufsize);

	goto out;
out_data_grew:
	printk(KERN_ERR "smb_trans2: data/params grew!\n");
	goto out_EIO;
	goto out;
out_bad_parm:
	printk(KERN_ERR "smb_trans2: invalid parms, disp=%u, cnt=%u, tot=%u, ofs=%u\n",
	       parm_disp, parm_count, parm_tot, parm_offset);
	goto out_EIO;
	goto out;
out_bad_data:
	printk(KERN_ERR "smb_trans2: invalid data, disp=%u, cnt=%u, tot=%u, ofs=%u\n",
	       data_disp, data_count, data_tot, data_offset);
out_EIO:
	req->rq_errno = -EIO;
out:
	return req->rq_errno;

Return to bug 61204

Lines 588-595 Link Here

(-)linux.vanilla-2.6.10/fs/smbfs/request.c (-19 / +33 lines)
588	data_count = WVAL(inbuf, smb_drcnt);	588	data_count = WVAL(inbuf, smb_drcnt);
589		589
590	/* Modify offset for the split header/buffer we use */	590	/* Modify offset for the split header/buffer we use */
591	data_offset -= hdrlen;	591	if (data_count \|\| data_offset) {
592	parm_offset -= hdrlen;	592	if (unlikely(data_offset < hdrlen))
		593	goto out_bad_data;
		594	else
		595	data_offset -= hdrlen;
		596	}
		597	if (parm_count \|\| parm_offset) {
		598	if (unlikely(parm_offset < hdrlen))
		599	goto out_bad_parm;
		600	else
		601	parm_offset -= hdrlen;
		602	}
593		603
594	if (parm_count == parm_tot && data_count == data_tot) {	604	if (parm_count == parm_tot && data_count == data_tot) {
595	/*	605	/*
Lines 600-617 Link Here
600	* response that fits.	610	* response that fits.
601	*/	611	*/
602	VERBOSE("single trans2 response "	612	VERBOSE("single trans2 response "
603	"dcnt=%d, pcnt=%d, doff=%d, poff=%d\n",	613	"dcnt=%u, pcnt=%u, doff=%u, poff=%u\n",
604	data_count, parm_count,	614	data_count, parm_count,
605	data_offset, parm_offset);	615	data_offset, parm_offset);
606	req->rq_ldata = data_count;	616	req->rq_ldata = data_count;
607	req->rq_lparm = parm_count;	617	req->rq_lparm = parm_count;
608	req->rq_data = req->rq_buffer + data_offset;	618	req->rq_data = req->rq_buffer + data_offset;
609	req->rq_parm = req->rq_buffer + parm_offset;	619	req->rq_parm = req->rq_buffer + parm_offset;
		620	if (unlikely(parm_offset + parm_count > req->rq_rlen))
		621	goto out_bad_parm;
		622	if (unlikely(data_offset + data_count > req->rq_rlen))
		623	goto out_bad_data;
610	return 0;	624	return 0;
611	}	625	}
612		626
613	VERBOSE("multi trans2 response "	627	VERBOSE("multi trans2 response "
614	"frag=%d, dcnt=%d, pcnt=%d, doff=%d, poff=%d\n",	628	"frag=%d, dcnt=%u, pcnt=%u, doff=%u, poff=%u\n",
615	req->rq_fragment,	629	req->rq_fragment,
616	data_count, parm_count,	630	data_count, parm_count,
617	data_offset, parm_offset);	631	data_offset, parm_offset);
Lines 638-650 Link Here
638		652
639	req->rq_parm = req->rq_trans2buffer;	653	req->rq_parm = req->rq_trans2buffer;
640	req->rq_data = req->rq_trans2buffer + parm_tot;	654	req->rq_data = req->rq_trans2buffer + parm_tot;
641	} else if (req->rq_total_data < data_tot \|\|	655	} else if (unlikely(req->rq_total_data < data_tot \|\|
642	req->rq_total_parm < parm_tot)	656	req->rq_total_parm < parm_tot))
643	goto out_data_grew;	657	goto out_data_grew;
644		658
645	if (parm_disp + parm_count > req->rq_total_parm)	659	if (unlikely(parm_disp + parm_count > req->rq_total_parm \|\|
		660	parm_offset + parm_count > req->rq_rlen))
646	goto out_bad_parm;	661	goto out_bad_parm;
647	if (data_disp + data_count > req->rq_total_data)	662	if (unlikely(data_disp + data_count > req->rq_total_data \|\|
		663	data_offset + data_count > req->rq_rlen))
648	goto out_bad_data;	664	goto out_bad_data;
649		665
650	inbuf = req->rq_buffer;	666	inbuf = req->rq_buffer;
Lines 666-675 Link Here
666	return 1;	682	return 1;
667		683
668	out_too_long:	684	out_too_long:
669	printk(KERN_ERR "smb_trans2: data/param too long, data=%d, parm=%d\n",	685	printk(KERN_ERR "smb_trans2: data/param too long, data=%u, parm=%u\n",
670	data_tot, parm_tot);	686	data_tot, parm_tot);
671	req->rq_errno = -EIO;	687	goto out_EIO;
672	goto out;
673	out_no_mem:	688	out_no_mem:
674	printk(KERN_ERR "smb_trans2: couldn't allocate data area of %d bytes\n",	689	printk(KERN_ERR "smb_trans2: couldn't allocate data area of %d bytes\n",
675	req->rq_trans2bufsize);	690	req->rq_trans2bufsize);
Lines 677-692 Link Here
677	goto out;	692	goto out;
678	out_data_grew:	693	out_data_grew:
679	printk(KERN_ERR "smb_trans2: data/params grew!\n");	694	printk(KERN_ERR "smb_trans2: data/params grew!\n");
680	req->rq_errno = -EIO;	695	goto out_EIO;
681	goto out;
682	out_bad_parm:	696	out_bad_parm:
683	printk(KERN_ERR "smb_trans2: invalid parms, disp=%d, cnt=%d, tot=%d\n",	697	printk(KERN_ERR "smb_trans2: invalid parms, disp=%u, cnt=%u, tot=%u, ofs=%u\n",
684	parm_disp, parm_count, parm_tot);	698	parm_disp, parm_count, parm_tot, parm_offset);
685	req->rq_errno = -EIO;	699	goto out_EIO;
686	goto out;
687	out_bad_data:	700	out_bad_data:
688	printk(KERN_ERR "smb_trans2: invalid data, disp=%d, cnt=%d, tot=%d\n",	701	printk(KERN_ERR "smb_trans2: invalid data, disp=%u, cnt=%u, tot=%u, ofs=%u\n",
689	data_disp, data_count, data_tot);	702	data_disp, data_count, data_tot, data_offset);
		703	out_EIO:
690	req->rq_errno = -EIO;	704	req->rq_errno = -EIO;
691	out:	705	out:
692	return req->rq_errno;	706	return req->rq_errno;