[linux-cifs-client] Re: LINUX kernel 2.6.23: bug in CIFSSMBSetEA

[smfrench at gmail.com]

On Dec 24, 2:50 pm, "Oleg Gvozdev" <123.o... at gmail.com> wrote:
> In fs/cifs/cifssmb.c, in CIFSSMBSetEA (...) function wrong counting of
> var exists.
>
> EXISTING CODE:
> pSMB->DataCount = sizeof(*parm_data) + ea_value_len + name_len + 1;
>
> MUST BE:
> pSMB->DataCount = sizeof(*parm_data) + ea_value_len + name_len;
>
> REASON:
>  "sizeof(*parm_data)"  counts 1 byte from "char name[1];"
>
> So, for example in Samba server (sources/smbd/trans2.c), we can see
> wrong processing of EA, cause data sent to server is bigger on 1 byte
> then it must be.
>
> See Extra info for details
>
> --------------------------------------------- Extra info
>
> struct fealist *parm_data;
>
> 1707 struct fea {
> 1708         unsigned char EA_flags;
> 1709         __u8 name_len;
> 1710         __u16 value_len;
> 1711         char name[1];
> 1712         /* optionally followed by value */
> 1713 };
> 1714 /* flags for _FEA.fEA */
> 1715 #define FEA_NEEDEA         0x80 /* need EA bit */
> 1716
> 1717 struct fealist {
> 1718         __u32 list_len;
> 1719         struct fea list[1];
> 1720 };


Yes - you are correct (note that Windows is less strict with the extra
pad byte than current Samba, and I don't remember seeing this with
older Samba server versions perhaps the length check ).

I have checked in a fix to the cifs development tree.  Thanks.