Dan Carpenter badf74b65f staging: ncpfs: memory corruption in ncp_read_kernel() ...

commit 4c41aa24ba upstream.

If the server is malicious then *bytes_read could be larger than the
size of the "target" buffer.  It would lead to memory corruption when we
do the memcpy().

Reported-by: Dr Silvio Cesare of InfoSect <Silvio Cesare <silvio.cesare@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-03-28 18:40:15 +02:00

..

dir.c

ncpfs: fix unused variable warning

2018-02-25 11:03:50 +01:00

file.c

switch generic_write_checks() to iocb and iter

2015-04-11 22:30:21 -04:00

getopt.c

…

getopt.h

…

inode.c

VFS: normal filesystems (and lustre): d_inode() annotations

2015-04-15 15:06:57 -04:00

ioctl.c

ncpfs: don't allow negative timeouts

2015-11-20 16:17:32 -08:00

Kconfig

…

Makefile

…

mmap.c

…

ncp_fs_i.h

…

ncp_fs_sb.h

…

ncp_fs.h

…

ncplib_kernel.c

staging: ncpfs: memory corruption in ncp_read_kernel()

2018-03-28 18:40:15 +02:00

ncplib_kernel.h

ncpfs: switch to ->read_iter/->write_iter

2015-04-11 22:28:52 -04:00

ncpsign_kernel.c

…

ncpsign_kernel.h

…

sock.c

…

symlink.c

VFS: normal filesystems (and lustre): d_inode() annotations

2015-04-15 15:06:57 -04:00