Windows: AFSParseMountPointTarget buffer overrun

When parsing the AFS mount point string do not overrun
the buffer if the colon cell/volume separator is not
found.

Change-Id: Id7275cc8815223730f7c39bd11a6f495beb117c4
Reviewed-on: http://gerrit.openafs.org/6507
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Peter Scott <pscott@kerneldrivers.com>
Tested-by: Jeffrey Altman <jaltman@secure-endpoints.com>
Reviewed-by: Jeffrey Altman <jaltman@secure-endpoints.com>

diff --git a/src/WINNT/afsrdr/kernel/lib/AFSFSControl.cpp b/src/WINNT/afsrdr/kernel/lib/AFSFSControl.cpp
index 2354043810e36de0834fb88e977e4f131c32440b..29dc20f8c92bd53d9f1e57c3893372e154501cd4 100644 (file)
--- a/src/WINNT/afsrdr/kernel/lib/AFSFSControl.cpp
+++ b/src/WINNT/afsrdr/kernel/lib/AFSFSControl.cpp
@@ -115,7 +115,8 @@ AFSParseMountPointTarget( IN  UNICODE_STRING *Target,
 
     // If a colon is not found, it means there is no cell
 
-    if ( Cell->Buffer[ Cell->Length / sizeof( WCHAR)] == L':')
+    if ( Cell->Length < Target->Length - sizeof( WCHAR) &&
+         Cell->Buffer[ Cell->Length / sizeof( WCHAR)] == L':')
     {
 
         Cell->MaximumLength = Cell->Length;