lkml.org 
[lkml]   [2018]   [Mar]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 30/43] staging: ncpfs: memory corruption in ncp_read_kernel()
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Dan Carpenter <dan.carpenter@oracle.com>

    commit 4c41aa24baa4ed338241d05494f2c595c885af8f upstream.

    If the server is malicious then *bytes_read could be larger than the
    size of the "target" buffer. It would lead to memory corruption when we
    do the memcpy().

    Reported-by: Dr Silvio Cesare of InfoSect <Silvio Cesare <silvio.cesare@gmail.com>
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/ncpfs/ncplib_kernel.c | 4 ++++
    1 file changed, 4 insertions(+)

    --- a/fs/ncpfs/ncplib_kernel.c
    +++ b/fs/ncpfs/ncplib_kernel.c
    @@ -980,6 +980,10 @@ ncp_read_kernel(struct ncp_server *serve
    goto out;
    }
    *bytes_read = ncp_reply_be16(server, 0);
    + if (*bytes_read > to_read) {
    + result = -EINVAL;
    + goto out;
    + }
    source = ncp_reply_data(server, 2 + (offset & 1));

    memcpy(target, source, *bytes_read);

    \
     
     \ /
      Last update: 2018-03-27 20:04    [W:2.095 / U:0.144 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site