Re: [PATCH] smb: client: reject short SESSION_SETUP responses

[Paulo Alcantara]

Abdifatah Suruur <suruurism@xxxxxxxxx> writes:

> smb2_check_message() accepts frames shorter than struct smb2_pdu when
> the SMB2 status is non-zero, before the minimum-PDU check added by
> b4694f269e66d. A 64-byte STATUS_MORE_PROCESSING_REQUIRED SESSION_SETUP
> response is therefore accepted even though it cannot contain the
> SecurityBufferOffset and SecurityBufferLength fields.
>
> The parser then reads those fields from stale bytes left in the reused
> receive buffer by an earlier frame. With a long stale
> SecurityBufferLength, decode_ntlmssp_challenge() copies up to about
> 64 KB from beyond the receive object and sends the data back to the
> server in the NTLMv2 AUTHENTICATE target info.
>
> Reject short MPR SESSION_SETUP responses before the short-error path,
> and validate SecurityBufferOffset + SecurityBufferLength against the
> received response length before decoding the challenge.
> ...

Applied.