smb: client: fix OOB in receive_encrypted_standard()
authorPaulo Alcantara <pc@manguebit.com>
Mon, 11 Dec 2023 13:26:40 +0000 (10:26 -0300)
committerSteve French <stfrench@microsoft.com>
Mon, 11 Dec 2023 18:30:39 +0000 (12:30 -0600)
commiteec04ea119691e65227a97ce53c0da6b9b74b0b7
treee8146e5823d313cbce452c3b4ab45e397e75f02b
parenta39b6ac3781d46ba18193c9dbb2110f31e9bffe9
smb: client: fix OOB in receive_encrypted_standard()

Fix potential OOB in receive_encrypted_standard() if server returned a
large shdr->NextCommand that would end up writing off the end of
@next_buffer.

Fixes: b24df3e30cbf ("cifs: update receive_encrypted_standard to handle compounded responses")
Cc: stable@vger.kernel.org
Reported-by: Robert Morris <rtm@csail.mit.edu>
Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/smb/client/smb2ops.c