From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Howells Subject: Re: [PATCH 1/5] cifs: change bleft in decode_unicode_ssetup back to signed type Date: Tue, 26 Apr 2011 15:10:19 +0100 Message-ID: <17428.1303827019@redhat.com> References: <1303819401-14789-2-git-send-email-jlayton@redhat.com> <1303819401-14789-1-git-send-email-jlayton@redhat.com> Cc: dhowells-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, smfrench-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org, linux-cifs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Jeff Layton Return-path: In-Reply-To: <1303819401-14789-2-git-send-email-jlayton-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> Sender: linux-cifs-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-ID: Jeff Layton wrote: > The buffer length checks in this function depend on this value being a > signed data type, but 690c522fa converted it to an unsigned type. > > Also, eliminate a problem with the null termination check in the same > function. cifs_strndup_from_ucs handles that situation correctly > already, and the existing check could potentially lead to a buffer > overrun since it increments bleft without checking to see whether it > falls off the end of the buffer. > > Cc: stable-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org > Reported-by: David Howells > Signed-off-by: Jeff Layton Acked-by: David Howells