From dd26bc067e44956e43a273e6e0a9c1fc4ed32cb7 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Pali=20Roh=C3=A1r?= Date: Mon, 23 Sep 2024 22:56:46 +0200 Subject: [PATCH] cifs: Validate content of native symlink MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Check that path buffer has correct length (it is non-zero and in UNICODE mode it has even number of bytes) and check that buffer does not contain null character (UTF-16 null codepoint in UNICODE mode or null byte in non-unicode mode) because Linux cannot process symlink with null byte. Signed-off-by: Pali Rohár Signed-off-by: Steve French --- fs/smb/client/reparse.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/fs/smb/client/reparse.c b/fs/smb/client/reparse.c index f74d0a86f44a..f563fd332a1b 100644 --- a/fs/smb/client/reparse.c +++ b/fs/smb/client/reparse.c @@ -547,6 +547,25 @@ int smb2_parse_native_symlink(char **target, const char *buf, unsigned int len, int rc; int i; + /* Check that length it valid for unicode/non-unicode mode */ + if (!len || (unicode && (len % 2))) { + cifs_dbg(VFS, "srv returned malformed symlink buffer\n"); + rc = -EIO; + goto out; + } + + /* + * Check that buffer does not contain UTF-16 null codepoint in unicode + * mode or null byte in non-unicode mode because Linux cannot process + * symlink with null byte. + */ + if ((unicode && UniStrnlen((wchar_t *)buf, len/2) != len/2) || + (!unicode && strnlen(buf, len) != len)) { + cifs_dbg(VFS, "srv returned null byte in native symlink target location\n"); + rc = -EIO; + goto out; + } + smb_target = cifs_strndup_from_utf16(buf, len, unicode, cifs_sb->local_nls); if (!smb_target) { rc = -ENOMEM; -- 2.20.1