summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorSuresh Jayaraman <sjayaraman@suse.de>2009-05-09 11:22:47 +0530
committerGreg Kroah-Hartman <gregkh@suse.de>2009-05-18 16:34:57 -0700
commite9012cf5e92b7812f5fc88fdd1ddaecc34a5b904 (patch)
treecaa8fd7a8b8f33dcfb89091c62ec4d6b620bceb9
parent5b0ecf297e133be1e4767b1e446a6d7902274c13 (diff)
downloadlwn-e9012cf5e92b7812f5fc88fdd1ddaecc34a5b904.tar.gz
lwn-e9012cf5e92b7812f5fc88fdd1ddaecc34a5b904.zip
cifs: Increase size of tmp_buf in cifs_readdir to avoid potential overflows
Commit 7b0c8fcff47a885743125dd843db64af41af5a61 refreshed and use a #define from commit f58841666bc22e827ca0dcef7b71c7bc2758ce82. cifs: Increase size of tmp_buf in cifs_readdir to avoid potential overflows Increase size of tmp_buf to possible maximum to avoid potential overflows. Also moved UNICODE_NAME_MAX definition so that it can be used elsewhere. Pointed-out-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Suresh Jayaraman <sjayaraman@suse.de> Acked-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve French <sfrench@us.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r--fs/cifs/cifs_unicode.h7
-rw-r--r--fs/cifs/readdir.c2
2 files changed, 8 insertions, 1 deletions
diff --git a/fs/cifs/cifs_unicode.h b/fs/cifs/cifs_unicode.h
index 14eb9a2395d3..604ce8a526a4 100644
--- a/fs/cifs/cifs_unicode.h
+++ b/fs/cifs/cifs_unicode.h
@@ -64,6 +64,13 @@ int cifs_strtoUCS(__le16 *, const char *, int, const struct nls_table *);
#endif
/*
+ * To be safe - for UCS to UTF-8 with strings loaded with the rare long
+ * characters alloc more to account for such multibyte target UTF-8
+ * characters.
+ */
+#define UNICODE_NAME_MAX ((4 * NAME_MAX) + 2)
+
+/*
* UniStrcat: Concatenate the second string to the first
*
* Returns:
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index c2c01ff4c32c..0bdd5a6e5bb8 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -1072,7 +1072,7 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
with the rare long characters alloc more to account for
such multibyte target UTF-8 characters. cifs_unicode.c,
which actually does the conversion, has the same limit */
- tmp_buf = kmalloc((2 * NAME_MAX) + 4, GFP_KERNEL);
+ tmp_buf = kmalloc(UNICODE_NAME_MAX, GFP_KERNEL);
for (i = 0; (i < num_to_fill) && (rc == 0); i++) {
if (current_entry == NULL) {
/* evaluate whether this case is an error */