svn commit: samba r22291 - in branches: SAMBA_3_0/source/smbd SAMBA_3_0_25/source/smbd

[jra at samba.org]

Author: jra
Date: 2007-04-17 02:14:28 +0000 (Tue, 17 Apr 2007)
New Revision: 22291

WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=22291

Log:
Fix off-by-one in tconX parsing.
Jeremy.

Modified:
   branches/SAMBA_3_0/source/smbd/reply.c
   branches/SAMBA_3_0_25/source/smbd/reply.c


Changeset:
Modified: branches/SAMBA_3_0/source/smbd/reply.c
===================================================================
--- branches/SAMBA_3_0/source/smbd/reply.c	2007-04-17 01:32:55 UTC (rev 22290)
+++ branches/SAMBA_3_0/source/smbd/reply.c	2007-04-17 02:14:28 UTC (rev 22291)
@@ -469,13 +469,22 @@
  
 	if (global_encrypted_passwords_negotiated) {
 		password = data_blob(smb_buf(inbuf),passlen);
+		if (lp_security() == SEC_SHARE) {
+			/*
+			 * Security = share always has a pad byte
+			 * after the password.
+			 */
+			p = smb_buf(inbuf) + passlen + 1;
+		} else {
+			p = smb_buf(inbuf) + passlen;
+		}
 	} else {
 		password = data_blob(smb_buf(inbuf),passlen+1);
 		/* Ensure correct termination */
-		password.data[passlen]=0;    
+		password.data[passlen]=0;
+		p = smb_buf(inbuf) + passlen + 1;
 	}
 
-	p = smb_buf(inbuf) + passlen;
 	p += srvstr_pull_buf(inbuf, path, p, sizeof(path), STR_TERMINATE);
 
 	/*

Modified: branches/SAMBA_3_0_25/source/smbd/reply.c
===================================================================
--- branches/SAMBA_3_0_25/source/smbd/reply.c	2007-04-17 01:32:55 UTC (rev 22290)
+++ branches/SAMBA_3_0_25/source/smbd/reply.c	2007-04-17 02:14:28 UTC (rev 22291)
@@ -468,13 +468,22 @@
  
 	if (global_encrypted_passwords_negotiated) {
 		password = data_blob(smb_buf(inbuf),passlen);
+		if (lp_security() == SEC_SHARE) {
+			/*
+			 * Security = share always has a pad byte
+			 * after the password.
+			 */
+			p = smb_buf(inbuf) + passlen + 1;
+		} else {
+			p = smb_buf(inbuf) + passlen;
+		}
 	} else {
 		password = data_blob(smb_buf(inbuf),passlen+1);
 		/* Ensure correct termination */
-		password.data[passlen]=0;    
+		password.data[passlen]=0;
+		p = smb_buf(inbuf) + passlen + 1;
 	}
 
-	p = smb_buf(inbuf) + passlen;
 	p += srvstr_pull_buf(inbuf, path, p, sizeof(path), STR_TERMINATE);
 
 	/*