@@ -4302,6 +4302,101 @@ SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms,
4302
4302
return rc ;
4303
4303
}
4304
4304
4305
+ static int posix_info_sid_size (const void * beg , const void * end )
4306
+ {
4307
+ size_t subauth ;
4308
+ int total ;
4309
+
4310
+ if (beg + 1 > end )
4311
+ return -1 ;
4312
+
4313
+ subauth = * (u8 * )(beg + 1 );
4314
+ if (subauth < 1 || subauth > 15 )
4315
+ return -1 ;
4316
+
4317
+ total = 1 + 1 + 6 + 4 * subauth ;
4318
+ if (beg + total > end )
4319
+ return -1 ;
4320
+
4321
+ return total ;
4322
+ }
4323
+
4324
+ int posix_info_parse (const void * beg , const void * end ,
4325
+ struct smb2_posix_info_parsed * out )
4326
+
4327
+ {
4328
+ int total_len = 0 ;
4329
+ int sid_len ;
4330
+ int name_len ;
4331
+ const void * owner_sid ;
4332
+ const void * group_sid ;
4333
+ const void * name ;
4334
+
4335
+ /* if no end bound given, assume payload to be correct */
4336
+ if (!end ) {
4337
+ const struct smb2_posix_info * p = beg ;
4338
+
4339
+ end = beg + le32_to_cpu (p -> NextEntryOffset );
4340
+ /* last element will have a 0 offset, pick a sensible bound */
4341
+ if (end == beg )
4342
+ end += 0xFFFF ;
4343
+ }
4344
+
4345
+ /* check base buf */
4346
+ if (beg + sizeof (struct smb2_posix_info ) > end )
4347
+ return -1 ;
4348
+ total_len = sizeof (struct smb2_posix_info );
4349
+
4350
+ /* check owner sid */
4351
+ owner_sid = beg + total_len ;
4352
+ sid_len = posix_info_sid_size (owner_sid , end );
4353
+ if (sid_len < 0 )
4354
+ return -1 ;
4355
+ total_len += sid_len ;
4356
+
4357
+ /* check group sid */
4358
+ group_sid = beg + total_len ;
4359
+ sid_len = posix_info_sid_size (group_sid , end );
4360
+ if (sid_len < 0 )
4361
+ return -1 ;
4362
+ total_len += sid_len ;
4363
+
4364
+ /* check name len */
4365
+ if (beg + total_len + 4 > end )
4366
+ return -1 ;
4367
+ name_len = le32_to_cpu (* (__le32 * )(beg + total_len ));
4368
+ if (name_len < 1 || name_len > 0xFFFF )
4369
+ return -1 ;
4370
+ total_len += 4 ;
4371
+
4372
+ /* check name */
4373
+ name = beg + total_len ;
4374
+ if (name + name_len > end )
4375
+ return -1 ;
4376
+ total_len += name_len ;
4377
+
4378
+ if (out ) {
4379
+ out -> base = beg ;
4380
+ out -> size = total_len ;
4381
+ out -> name_len = name_len ;
4382
+ out -> name = name ;
4383
+ memcpy (& out -> owner , owner_sid ,
4384
+ posix_info_sid_size (owner_sid , end ));
4385
+ memcpy (& out -> group , group_sid ,
4386
+ posix_info_sid_size (group_sid , end ));
4387
+ }
4388
+ return total_len ;
4389
+ }
4390
+
4391
+ static int posix_info_extra_size (const void * beg , const void * end )
4392
+ {
4393
+ int len = posix_info_parse (beg , end , NULL );
4394
+
4395
+ if (len < 0 )
4396
+ return -1 ;
4397
+ return len - sizeof (struct smb2_posix_info );
4398
+ }
4399
+
4305
4400
static unsigned int
4306
4401
num_entries (char * bufstart , char * end_of_buf , char * * lastentry , size_t size )
4307
4402
{
0 commit comments