CIFS: Fix a potencially linear read overflow
authorLen Baker <len.baker@gmx.com>
Tue, 17 Aug 2021 10:27:09 +0000 (12:27 +0200)
committerSteve French <stfrench@microsoft.com>
Wed, 25 Aug 2021 20:42:15 +0000 (15:42 -0500)
commitf980d055a0f858d73d9467bb0b570721bbfcdfb8
tree4a7aaeadc83db7840b04621951e548548ec10a2d
parente22ce8eb631bdc47a4a4ea7ecf4e4ba499db4f93
CIFS: Fix a potencially linear read overflow

strlcpy() reads the entire source buffer first. This read may exceed the
destination size limit. This is both inefficient and can lead to linear
read overflows if a source string is not NUL-terminated.

Also, the strnlen() call does not avoid the read overflow in the strlcpy
function when a not NUL-terminated string is passed.

So, replace this block by a call to kstrndup() that avoids this type of
overflow and does the same.

Fixes: 066ce6899484d ("cifs: rename cifs_strlcpy_to_host and make it use new functions")
Signed-off-by: Len Baker <len.baker@gmx.com>
Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/cifs/cifs_unicode.c