[Bug 228354] mount_smbfs - long hostname causes stack overflow

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=228354

--- Comment #12 from commit-hook at freebsd.org ---
A commit references this bug:

Author: brooks
Date: Mon Jun 25 16:42:50 UTC 2018
New revision: 335641
URL: https://svnweb.freebsd.org/changeset/base/335641

Log:
  Fix a stack overflow in mount_smbfs when hostname is too long.

  The local hostname was blindly copied into the to the nn_name array.
  When the hostname exceeded 16 bytes, it would overflow.  Truncate the
  hostname to 15 bytes plus a 0 terminator which is the "workstation name"
  suffix.

  Use defensive strlcpy() when filling nn_name in all cases.

  PR:           228354
  Reported by:  donald.buchholz at intel.com
  Reviewed by:  jpaetzel,  ian (prior version)
  Discussed with:       Security Officer (gtetlow)
  MFC after:    3 days
  Security:     Stack overflow with the hostname.
  Sponsored by: DARPA, AFRL
  Differential Revision:        https://reviews.freebsd.org/D15936

Changes:
  head/contrib/smbfs/lib/smb/ctx.c
  head/contrib/smbfs/lib/smb/nbns_rq.c

-- 
You are receiving this mail because:
You are the assignee for the bug.