X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=fs%2Fsmbfs%2Frequest.c;h=13d1002195b8224ee1fae638a263cfb2d52fb381;hb=a9fdee76789476a10f923f9fb3c84993042da3ac;hp=8432a55ef0f3e0665bb54f79f9598c50bc2e7a18;hpb=8d40237c730b8be87c1b80a5d96b9c603fefa829;p=linux-2.6.git diff --git a/fs/smbfs/request.c b/fs/smbfs/request.c index 8432a55ef..13d100219 100644 --- a/fs/smbfs/request.c +++ b/fs/smbfs/request.c @@ -659,6 +659,7 @@ static int smb_recv_trans2(struct smb_sb_info *server, struct smb_request *req) if (unlikely(parm_disp + parm_count > req->rq_total_parm || parm_offset + parm_count > req->rq_rlen)) goto out_bad_parm; + if (unlikely(data_disp + data_count > req->rq_total_data || data_offset + data_count > req->rq_rlen)) goto out_bad_data;