diff options
| author | Suresh Jayaraman <sjayaraman@suse.de> | 2009-05-09 11:22:47 +0530 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2009-05-19 22:20:12 -0700 |
| commit | f1e9ce644becc2ff8865a3abb43dcfadefef093f (patch) | |
| tree | 0bc10be31ade5305e5bbfc2fcc718c5823b8ed32 | |
| parent | b26a2233617941def73064bee3fffb97ab6f073b (diff) | |
cifs: Increase size of tmp_buf in cifs_readdir to avoid potential overflows
Commit 7b0c8fcff47a885743125dd843db64af41af5a61 refreshed and use
a #define from commit f58841666bc22e827ca0dcef7b71c7bc2758ce82.
cifs: Increase size of tmp_buf in cifs_readdir to avoid potential overflows
Increase size of tmp_buf to possible maximum to avoid potential
overflows. Also moved UNICODE_NAME_MAX definition so that it can be used
elsewhere.
Pointed-out-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Suresh Jayaraman <sjayaraman@suse.de>
Acked-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | fs/cifs/cifs_unicode.h | 7 | ||||
| -rw-r--r-- | fs/cifs/readdir.c | 2 |
2 files changed, 8 insertions, 1 deletions
diff --git a/fs/cifs/cifs_unicode.h b/fs/cifs/cifs_unicode.h index 14eb9a2395d..604ce8a526a 100644 --- a/fs/cifs/cifs_unicode.h +++ b/fs/cifs/cifs_unicode.h @@ -64,6 +64,13 @@ int cifs_strtoUCS(__le16 *, const char *, int, const struct nls_table *); #endif /* + * To be safe - for UCS to UTF-8 with strings loaded with the rare long + * characters alloc more to account for such multibyte target UTF-8 + * characters. + */ +#define UNICODE_NAME_MAX ((4 * NAME_MAX) + 2) + +/* * UniStrcat: Concatenate the second string to the first * * Returns: diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c index 58d57299f2a..2878892688c 100644 --- a/fs/cifs/readdir.c +++ b/fs/cifs/readdir.c @@ -1075,7 +1075,7 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir) with the rare long characters alloc more to account for such multibyte target UTF-8 characters. cifs_unicode.c, which actually does the conversion, has the same limit */ - tmp_buf = kmalloc((2 * NAME_MAX) + 4, GFP_KERNEL); + tmp_buf = kmalloc(UNICODE_NAME_MAX, GFP_KERNEL); for (i = 0; (i < num_to_fill) && (rc == 0); i++) { if (current_entry == NULL) { /* evaluate whether this case is an error */ |