swh:1:snp:c3bf2749e3476071fa748f67b0ffa2fdc5fe49d9
Revision 0c26606cbe4937f2228a27bb0c2cad19855be87a authored by Tim Gardner on 13 October 2013, 19:29:03 UTC, committed by Steve French on 14 October 2013, 17:14:01 UTC
Functions that walk the ntstatus_to_dos_map[] array could
run off the end. For example, ntstatus_to_dos() loops
while ntstatus_to_dos_map[].ntstatus is not 0. Granted,
this is mostly theoretical, but could be used as a DOS attack
if the error code in the SMB header is bogus.

[Might consider adding to stable, as this patch is low risk - Steve]

Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Signed-off-by: Steve French <smfrench@gmail.com>
1 parent dde2356
History
Tip revision: d1221cea11fca0f6946bdd032a45b22cecfc0f99 authored by Linus Torvalds on 13 September 2022, 13:11:38 UTC
Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Tip revision: d1221ce
File Mode Size
Documentation
arch
block
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.gitignore -rw-r--r-- 1.1 KB
.mailmap -rw-r--r-- 4.4 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 93.0 KB
Kbuild -rw-r--r-- 2.5 KB
Kconfig -rw-r--r-- 252 bytes
MAINTAINERS -rw-r--r-- 257.5 KB
Makefile -rw-r--r-- 47.4 KB
README -rw-r--r-- 18.3 KB
REPORTING-BUGS -rw-r--r-- 7.3 KB

README

back to top