REDHAT-BUG-732869: High severity linux cifs vulnerability

The namelen variable in CIFSFindNext is a signed int that gets set to the resumenamelen in the cifssearchinfo. The resumenamelen however is unsigned and for some infolevels is populated directly from a 32 bit value sent by the server.

If the server sends a very large value for this, then that value could look negative when converted to a signed int. That would make that value pass the PATHMAX check later in CIFSFindNext. The namelen would then be used as a length value for a memcpy. It would then be treated as unsigned again, and the memcpy scribbles over a ton of memory.

Fix this by making the namelen an unsigned value in CIFSFindNext.

http://www.spinics.net/lists/linux-cifs/msg03950.html

Acknowledgements:

Red Hat would like to thank Darren Lavender for reporting this issue.