smb: client: fix OOB in receive_encrypted_standard()

Fix potential OOB in receive_encrypted_standard() if server returned a
large shdr->NextCommand that would end up writing off the end of
@next_buffer.

Fixes: b24df3e30cbf ("cifs: update receive_encrypted_standard to handle compounded responses")
Cc: stable@vger.kernel.org
Reported-by: Robert Morris <rtm@csail.mit.edu>
Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
index fcfb6566b899fb6c4b394cca215419396dcb293b..a6f4948adcbb01d5daedbedcfac3dcb92adbfaf1 100644 (file)
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -4943,6 +4943,7 @@ receive_encrypted_standard(struct TCP_Server_Info *server,
        struct smb2_hdr *shdr;
        unsigned int pdu_length = server->pdu_size;
        unsigned int buf_size;
+       unsigned int next_cmd;
        struct mid_q_entry *mid_entry;
        int next_is_large;
        char *next_buffer = NULL;
@@ -4971,14 +4972,15 @@ receive_encrypted_standard(struct TCP_Server_Info *server,
        next_is_large = server->large_buf;
 one_more:
        shdr = (struct smb2_hdr *)buf;
-       if (shdr->NextCommand) {
+       next_cmd = le32_to_cpu(shdr->NextCommand);
+       if (next_cmd) {
+               if (WARN_ON_ONCE(next_cmd > pdu_length))
+                       return -1;
                if (next_is_large)
                        next_buffer = (char *)cifs_buf_get();
                else
                        next_buffer = (char *)cifs_small_buf_get();
-               memcpy(next_buffer,
-                      buf + le32_to_cpu(shdr->NextCommand),
-                      pdu_length - le32_to_cpu(shdr->NextCommand));
+               memcpy(next_buffer, buf + next_cmd, pdu_length - next_cmd);
        }
 
        mid_entry = smb2_find_mid(server, buf);
@@ -5002,8 +5004,8 @@ one_more:
        else
                ret = cifs_handle_standard(server, mid_entry);
 
-       if (ret == 0 && shdr->NextCommand) {
-               pdu_length -= le32_to_cpu(shdr->NextCommand);
+       if (ret == 0 && next_cmd) {
+               pdu_length -= next_cmd;
                server->large_buf = next_is_large;
                if (next_is_large)
                        server->bigbuf = buf = next_buffer;