File tree Expand file tree Collapse file tree 1 file changed +3
-5
lines changed Expand file tree Collapse file tree 1 file changed +3
-5
lines changed Original file line number Diff line number Diff line change @@ -8395,20 +8395,18 @@ int smb3_decrypt_req(struct ksmbd_work *work)
8395
8395
struct smb2_hdr * hdr ;
8396
8396
unsigned int pdu_length = get_rfc1002_len (buf );
8397
8397
struct kvec iov [2 ];
8398
- unsigned int buf_data_size = pdu_length + 4 -
8398
+ int buf_data_size = pdu_length + 4 -
8399
8399
sizeof (struct smb2_transform_hdr );
8400
8400
struct smb2_transform_hdr * tr_hdr = (struct smb2_transform_hdr * )buf ;
8401
8401
int rc = 0 ;
8402
8402
8403
- if (pdu_length + 4 <
8404
- sizeof (struct smb2_transform_hdr ) + sizeof (struct smb2_hdr )) {
8403
+ if (buf_data_size < sizeof (struct smb2_hdr )) {
8405
8404
pr_err ("Transform message is too small (%u)\n" ,
8406
8405
pdu_length );
8407
8406
return - ECONNABORTED ;
8408
8407
}
8409
8408
8410
- if (pdu_length + 4 <
8411
- le32_to_cpu (tr_hdr -> OriginalMessageSize ) + sizeof (struct smb2_transform_hdr )) {
8409
+ if (buf_data_size < le32_to_cpu (tr_hdr -> OriginalMessageSize )) {
8412
8410
pr_err ("Transform message is broken\n" );
8413
8411
return - ECONNABORTED ;
8414
8412
}
You can’t perform that action at this time.
0 commit comments