diff options
| author | Steve French <stfrench@microsoft.com> | 2021-07-22 21:35:15 +0200 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2021-07-22 21:35:15 +0200 |
| commit | 7b09d4e0be94968b7c6c117e34ca90cea9c6d986 (patch) | |
| tree | a4beaa3e841a8f10e30779d3876abd0601900f5f /fs | |
| parent | CIFS: Clarify SMB1 code for POSIX Create (diff) | |
| download | linux-7b09d4e0be94968b7c6c117e34ca90cea9c6d986.tar.xz linux-7b09d4e0be94968b7c6c117e34ca90cea9c6d986.zip | |
CIFS: Clarify SMB1 code for POSIX delete file
Coverity also complains about the way we calculate the offset
(starting from the address of a 4 byte array within the
header structure rather than from the beginning of the struct
plus 4 bytes) for SMB1 CIFSPOSIXDelFile. This changeset
doesn't change the address but makes it slightly clearer.
Addresses-Coverity: 711519 ("Out of bounds write")
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/cifs/cifssmb.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c index d4144c182604..65d1a65bfc37 100644 --- a/fs/cifs/cifssmb.c +++ b/fs/cifs/cifssmb.c @@ -873,8 +873,11 @@ PsxDelete: InformationLevel) - 4; offset = param_offset + params; - /* Setup pointer to Request Data (inode type) */ - pRqD = (struct unlink_psx_rq *)(((char *)&pSMB->hdr.Protocol) + offset); + /* Setup pointer to Request Data (inode type). + * Note that SMB offsets are from the beginning of SMB which is 4 bytes + * in, after RFC1001 field + */ + pRqD = (struct unlink_psx_rq *)((char *)(pSMB) + offset + 4); pRqD->type = cpu_to_le16(type); pSMB->ParameterOffset = cpu_to_le16(param_offset); pSMB->DataOffset = cpu_to_le16(offset); |