From 80055f78a9696b7760c9f673671cb840ca9a3f46 Mon Sep 17 00:00:00 2001 From: Jerome Marchand Date: Thu, 26 May 2016 11:52:25 +0200 Subject: [PATCH] cifs: dynamic allocation of ntlmssp blob commit b8da344b74c822e966c6d19d6b2321efe82c5d97 upstream. In sess_auth_rawntlmssp_authenticate(), the ntlmssp blob is allocated statically and its size is an "empirical" 5*sizeof(struct _AUTHENTICATE_MESSAGE) (320B on x86_64). I don't know where this value comes from or if it was ever appropriate, but it is currently insufficient: the user and domain name in UTF16 could take 1kB by themselves. Because of that, build_ntlmssp_auth_blob() might corrupt memory (out-of-bounds write). The size of ntlmssp_blob in SMB2_sess_setup() is too small too (sizeof(struct _NEGOTIATE_MESSAGE) + 500). This patch allocates the blob dynamically in build_ntlmssp_auth_blob(). Signed-off-by: Jerome Marchand Signed-off-by: Steve French [bwh: Backported to 3.2: - Adjust context, indentation - build_ntlmssp_auth_blob() is static - Drop changes to smb2pdu.c - Use cERROR() instead of cifs_dbg(VFS, ...) - Use MAX_USERNAME_SIZE instead of CIFS_MAX_USERNAME_LEN] Signed-off-by: Ben Hutchings --- Reading git-format-patch failed