smb SymlinkData Overflow

Vulnerability analysis

When the SMB client processes a symlink error response from a server, it rounds up a data-length value supplied by the server before checking whether that length still fits inside the remaining message buffer. If the server provides a value near the maximum for a 32-bit integer, the rounding arithmetic wraps around to zero, so the bounds check succeeds and the parser gets stuck: it either stops moving forward and loops forever on the same data, or steps forward by only a fixed header size and later reads past the end of the buffer. The fix validates the original length against the remaining space before the rounding step, then checks the rounded length afterward, so a wrapped value can no longer pass both guards. Any client that has mounted a malicious or man-in-the-middle SMB share can be affected; the attacker does not need an account or privileges on the victim system.