[PATCH] smb: client: fix OOB array access in __smb2_calc_size() on unknown Command

[Frank Sorenson <sorenson@redhat.com>]

has_smb2_data_area[] is indexed by the server-supplied shdr->Command
with no bounds check:

    if (has_smb2_data_area[le16_to_cpu(shdr->Command)] == false)

The array has NUMBER_OF_SMB2_COMMANDS (0x13) entries; any Command value
>= 0x13 reads past the end into adjacent read-only data.

Add an upper-bound check before the lookup; commands outside the valid
range have no data area, so treat them as false.

Fixes: 093b2bdad322 ("CIFS: Make demultiplex_thread work with SMB2 code")
Cc: stable@vger.kernel.org
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
---
 fs/smb/client/smb2misc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/smb/client/smb2misc.c b/fs/smb/client/smb2misc.c
index 9068175e57cd..26b41ea3b72b 100644
--- a/fs/smb/client/smb2misc.c
+++ b/fs/smb/client/smb2misc.c
@@ -451,7 +451,8 @@ __smb2_calc_size(void *buf, bool *have_data, bool *data_area_overlap)
 	 */
 	len += le16_to_cpu(pdu->StructureSize2);
 
-	if (has_smb2_data_area[le16_to_cpu(shdr->Command)] == false)
+	if (le16_to_cpu(shdr->Command) >= ARRAY_SIZE(has_smb2_data_area) ||
+	    !has_smb2_data_area[le16_to_cpu(shdr->Command)])
 		goto calc_size_exit;
 
 	smb2_get_data_area_len(&offset, &data_length, shdr);
-- 
2.55.0