diff options
| author | VeroFess <coderzeng@hotmail.com> | 2026-10-26 15:01:03 +0900 |
|---|---|---|
| committer | Namjae Jeon <linkinjeon@kernel.org> | 2026-10-26 19:15:41 +0900 |
| commit | f1f37834eaba5904103af1f18afe3510c7e9dc71 (patch) | |
| tree | 77c203f7571873503127a63caee9a7d2f8deefdc /scripts/basic/split-include.c | |
| parent | 19f8fd6b5ced33b02a083759e6901f9d6e8076df (diff) | |
| download | linux-f1f37834eaba5904103af1f18afe3510c7e9dc71.tar.gz linux-f1f37834eaba5904103af1f18afe3510c7e9dc71.zip | |
smb: server: size directory name conversion buffer correctly
A 2048-byte ASCII directory name needs 4098 bytes when converted to
UTF-16, including the terminator. ksmbd_convert_dir_info_name() caps
its allocation at PATH_MAX and writes past the end of that buffer.
Allocate space for one UTF-16 code unit per input byte plus the
terminator. Use kmalloc_array() to check the size calculation.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Assisted-by: gpt 6 sol with daybreak blue
Signed-off-by: VeroFess <coderzeng@hotmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Diffstat (limited to 'scripts/basic/split-include.c')
0 files changed, 0 insertions, 0 deletions