svn commit: samba r3936 - in branches/SAMBA_3_0/source/smbd: .
jra at samba.org
jra at samba.org
Wed Nov 24 05:24:41 GMT 2004
Author: jra
Date: 2004-11-24 05:24:38 +0000 (Wed, 24 Nov 2004)
New Revision: 3936
WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=3936
Log:
Ensure LARGE_READX response must fit within reply buffer.
Jeremy.
Modified:
branches/SAMBA_3_0/source/smbd/reply.c
Changeset:
Modified: branches/SAMBA_3_0/source/smbd/reply.c
===================================================================
--- branches/SAMBA_3_0/source/smbd/reply.c 2004-11-24 05:24:32 UTC (rev 3935)
+++ branches/SAMBA_3_0/source/smbd/reply.c 2004-11-24 05:24:38 UTC (rev 3936)
@@ -2186,6 +2186,12 @@
if (global_client_caps & CAP_LARGE_READX) {
smb_maxcnt |= ((((size_t)SVAL(inbuf,smb_vwv7)) & 1 )<<16);
+ if (smb_maxcnt > BUFFER_SIZE) {
+ DEBUG(0,("reply_read_and_X - read too large (%u) for reply buffer %u\n",
+ (unsigned int)smb_maxcnt, (unsigned int)BUFFER_SIZE));
+ END_PROFILE(SMBreadX);
+ return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+ }
}
if(CVAL(inbuf,smb_wct) == 12) {
More information about the samba-cvs
mailing list