From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Howells Subject: Re: [PATCH 2/5] cifs: check for bytes_remaining going to zero in CIFS_SessSetup Date: Tue, 26 Apr 2011 15:11:33 +0100 Message-ID: <17452.1303827093@redhat.com> References: <1303819401-14789-3-git-send-email-jlayton@redhat.com> <1303819401-14789-1-git-send-email-jlayton@redhat.com> Cc: dhowells-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, smfrench-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org, linux-cifs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Jeff Layton Return-path: In-Reply-To: <1303819401-14789-3-git-send-email-jlayton-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> Sender: linux-cifs-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-ID: Jeff Layton wrote: > It's possible that when we go to decode the string area in the > SESSION_SETUP response, that bytes_remaining will be 0. Decrementing it at > that point will mean that it can go "negative" and wrap. Check for a > bytes_remaining value of 0, and don't try to decode the string area if > that's the case. > > Cc: stable-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org > Reported-by: David Howells > Signed-off-by: Jeff Layton Acked-by: David Howells