HomeFreeBSD

netsmb: Fix buggy/racy smb_strdupin()

Description

netsmb: Fix buggy/racy smb_strdupin()

smb_strdupin() tried to roll a copyin() based strlen to allocate a buffer
and then blindly copyin that size. Of course, a malicious user program
could simultaneously manipulate the buffer, resulting in a non-terminated
string being copied.

Later assumptions in the code rely upon the string being nul-terminated.

Just use copyinstr() and drop the racy sizing.

PR: 222687
Reported by: Meng Xu <meng.xu AT gatech.edu>
Security: possible local DoS
Sponsored by: Dell EMC Isilon

Details

Provenance
cemAuthored on Sep 29 2017, 3:53 PM
Parents
rG451c2bec47d1: man(1): silent the output of mandoc when testing
Branches
Unknown
Tags
Unknown

Event Timeline