)]}'
{
  "commit": "05762c5bc1cfdcac36747994fde2c04387a457f1",
  "tree": "ea934861ba0adbef380fdfe4b7cf6ca8c934f8bc",
  "parents": [
    "d034e836eefd7ce75e588f7031cffbeec594f5ac"
  ],
  "author": {
    "name": "Frank Sorenson",
    "email": "sorenson@redhat.com",
    "time": "Wed Sep 16 16:33:52 2026 -0500"
  },
  "committer": {
    "name": "Paulo Alcantara",
    "email": "pc@manguebit.org",
    "time": "Thu Sep 17 15:03:27 2026 -0300"
  },
  "message": "smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs\n\nFix several related bounds checking and pointer lifecycle issues in\nreceive_encrypted_standard()\u0027s handling of compound encrypted frames:\n\n- Clear next_buffer after assigning it to server-\u003ebigbuf. A stale\n  next_buffer pointer can lead to a use-after-free on subsequent\n  error paths.\n- Update pdu_length to the decrypted plaintext size (buf_size). Using\n  the pre-decryption length allows NextCommand to point into stale\n  ciphertext residue.\n- Reject next_cmd values smaller than MID_HEADER_SIZE(server).\n- Fix an integer overflow in the upper bound check by verifying\n  pdu_length - next_cmd \u003c MID_HEADER_SIZE(server), ensuring the\n  trailing slice is large enough for a header.\n\nFixes: b24df3e30cbf (\"cifs: update receive_encrypted_standard to handle compounded responses\")\nCc: stable@vger.kernel.org\nSigned-off-by: Frank Sorenson \u003csorenson@redhat.com\u003e\nReviewed-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Paulo Alcantara \u003cpc@manguebit.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "cb4fd09f996e0290103f6d892a485c49b06d3c08",
      "old_mode": 33188,
      "old_path": "fs/smb/client/smb2ops.c",
      "new_id": "fcf7033889c7ead2403d676cfc398f195554fb6a",
      "new_mode": 33188,
      "new_path": "fs/smb/client/smb2ops.c"
    }
  ]
}