ksmbd: fix multiple out-of-bounds read during context decoding
authorKuan-Ting Chen <h3xrabbit@gmail.com>
Fri, 19 May 2023 14:00:24 +0000 (23:00 +0900)
committerSteve French <stfrench@microsoft.com>
Sat, 27 May 2023 01:27:46 +0000 (20:27 -0500)
commit0512a5f89e1fae74251fde6893ff634f1c96c6fb
treefdf81b0b3f914d38a1ac67f6d1be36038e4cb8b4
parentd738950f112c8f40f0515fe967db998e8235a175
ksmbd: fix multiple out-of-bounds read during context decoding

Check the remaining data length before accessing the context structure
to ensure that the entire structure is contained within the packet.
Additionally, since the context data length `ctxt_len` has already been
checked against the total packet length `len_of_ctxts`, update the
comparison to use `ctxt_len`.

Cc: stable@vger.kernel.org
Signed-off-by: Kuan-Ting Chen <h3xrabbit@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/smb/server/smb2pdu.c