diff options
| author | David S. Miller <davem@davemloft.net> | 2008-06-14 05:52:39 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-06-14 05:52:39 +0200 |
| commit | 4ae127d1b6c71f9240dd4245f240e6dd8fc98014 (patch) | |
| tree | b7aa27b3e0c655f4613fe2146cb57d7f69e421f6 /fs/cifs/asn1.c | |
| parent | udp: reorder udp_iter_state to remove padding on 64bit builds (diff) | |
| parent | Merge git://git.kernel.org/pub/scm/linux/kernel/git/kyle/parisc-2.6 (diff) | |
| download | linux-4ae127d1b6c71f9240dd4245f240e6dd8fc98014.tar.xz linux-4ae127d1b6c71f9240dd4245f240e6dd8fc98014.zip | |
Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
Conflicts:
drivers/net/smc911x.c
Diffstat (limited to 'fs/cifs/asn1.c')
| -rw-r--r-- | fs/cifs/asn1.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c index cb52cbbe45ff..f58e41d3ba48 100644 --- a/fs/cifs/asn1.c +++ b/fs/cifs/asn1.c @@ -186,6 +186,11 @@ asn1_length_decode(struct asn1_ctx *ctx, unsigned int *def, unsigned int *len) } } } + + /* don't trust len bigger than ctx buffer */ + if (*len > ctx->end - ctx->pointer) + return 0; + return 1; } @@ -203,6 +208,10 @@ asn1_header_decode(struct asn1_ctx *ctx, if (!asn1_length_decode(ctx, &def, &len)) return 0; + /* primitive shall be definite, indefinite shall be constructed */ + if (*con == ASN1_PRI && !def) + return 0; + if (def) *eoc = ctx->pointer + len; else @@ -389,6 +398,11 @@ asn1_oid_decode(struct asn1_ctx *ctx, unsigned long *optr; size = eoc - ctx->pointer + 1; + + /* first subid actually encodes first two subids */ + if (size < 2 || size > ULONG_MAX/sizeof(unsigned long)) + return 0; + *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC); if (*oid == NULL) return 0; |