]> CyberLeo.Net >> Repos - FreeBSD/stable/10.git/commit
MFC r335641:
authorbrooks <brooks@ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f>
Thu, 28 Jun 2018 21:23:05 +0000 (21:23 +0000)
committerbrooks <brooks@ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f>
Thu, 28 Jun 2018 21:23:05 +0000 (21:23 +0000)
commitecbfaf82780cc3102b3c7801bde84721c3980899
treef59265437141766ef676359413728f2b94e3f905
parentf0bf1618d702ffa548ca303b4acc33a733b4a0ae
MFC r335641:

Fix a stack overflow in mount_smbfs when hostname is too long.

The local hostname was blindly copied into the to the nn_name array.
When the hostname exceeded 16 bytes, it would overflow.  Truncate the
hostname to 15 bytes plus a 0 terminator which is the "workstation name"
suffix.

Use defensive strlcpy() when filling nn_name in all cases.

PR: 228354
Reported by: donald.buchholz@intel.com
Reviewed by: jpaetzel,  ian (prior version)
Discussed with: Security Officer (gtetlow)
Security: Stack overflow with the hostname.
Sponsored by: DARPA, AFRL
Differential Revision: https://reviews.freebsd.org/D15936

git-svn-id: svn://svn.freebsd.org/base/stable/10@335781 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f
contrib/smbfs/lib/smb/ctx.c
contrib/smbfs/lib/smb/nbns_rq.c