From: Jeff Layton Date: Wed, 17 Dec 2008 11:31:53 +0000 (-0500) Subject: cifs: fix buffer overrun in parse_DFS_referrals X-Git-Tag: v2.6.28-rc9~10 X-Git-Url: http://www.pilppa.org/gitweb/gitweb.cgi?p=linux-2.6-omap-h63xx.git;a=commitdiff_plain;h=331c31351044888916805c9cb32d8bb9e40c12e9 cifs: fix buffer overrun in parse_DFS_referrals While testing a kernel with memory poisoning enabled, I saw some warnings about the redzone getting clobbered when chasing DFS referrals. The buffer allocation for the unicode converted version of the searchName is too small and needs to take null termination into account. Signed-off-by: Jeff Layton Acked-by: Steve French Signed-off-by: Linus Torvalds --- diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c index 2af8626ced4..6d51696dc76 100644 --- a/fs/cifs/cifssmb.c +++ b/fs/cifs/cifssmb.c @@ -3983,7 +3983,8 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr, node->flags = le16_to_cpu(pSMBr->DFSFlags); if (is_unicode) { - __le16 *tmp = kmalloc(strlen(searchName)*2, GFP_KERNEL); + __le16 *tmp = kmalloc(strlen(searchName)*2 + 2, + GFP_KERNEL); cifsConvertToUCS((__le16 *) tmp, searchName, PATH_MAX, nls_codepage, remap); node->path_consumed = hostlen_fromUCS(tmp,