diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-01-11 10:46:27 +0300 |
|---|---|---|
| committer | Steve French <smfrench@gmail.com> | 2012-01-12 13:17:36 -0600 |
| commit | 7250170c9ed00f3b74b11b98afefab45020672dd (patch) | |
| tree | 5e79741f1865a3aef840e68d7db9e7ed4d685b5a | |
| parent | a429638cac1e5c656818a45aaff78df7b743004e (diff) | |
| download | linux-7250170c9ed00f3b74b11b98afefab45020672dd.tar.bz2 | |
cifs: integer overflow in parse_dacl()
On 32 bit systems num_aces * sizeof(struct cifs_ace *) could overflow
leading to a smaller ppace buffer than we expected.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Jeff Layton <jlayton@samba.org>
Signed-off-by: Steve French <smfrench@gmail.com>
| -rw-r--r-- | fs/cifs/cifsacl.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c index 72ddf23ef6f7..c1b254487388 100644 --- a/fs/cifs/cifsacl.c +++ b/fs/cifs/cifsacl.c @@ -909,6 +909,8 @@ static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl, umode_t group_mask = S_IRWXG; umode_t other_mask = S_IRWXU | S_IRWXG | S_IRWXO; + if (num_aces > ULONG_MAX / sizeof(struct cifs_ace *)) + return; ppace = kmalloc(num_aces * sizeof(struct cifs_ace *), GFP_KERNEL); if (!ppace) { |