svn commit: samba r24349 - in branches/SAMBA_3_2/source/smbd: .
vlendec at samba.org
vlendec at samba.org
Sun Aug 12 12:15:34 GMT 2007
Author: vlendec
Date: 2007-08-12 12:15:32 +0000 (Sun, 12 Aug 2007)
New Revision: 24349
WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=24349
Log:
For large read&x we need more than 64k of outbuf.
Modified:
branches/SAMBA_3_2/source/smbd/process.c
Changeset:
Modified: branches/SAMBA_3_2/source/smbd/process.c
===================================================================
--- branches/SAMBA_3_2/source/smbd/process.c 2007-08-12 11:40:27 UTC (rev 24348)
+++ branches/SAMBA_3_2/source/smbd/process.c 2007-08-12 12:15:32 UTC (rev 24349)
@@ -953,8 +953,19 @@
allocate and initialize a reply packet
********************************************************************/
-void reply_outbuf(struct smb_request *req, uint8 num_words, uint16 num_bytes)
+void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
{
+ /*
+ * Protect against integer wrap
+ */
+ if ((num_bytes > 0xffffff)
+ || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
+ char *msg;
+ asprintf(&msg, "num_bytes too large: %u",
+ (unsigned)num_bytes);
+ smb_panic(msg);
+ }
+
if (!(req->outbuf = TALLOC_ARRAY(
req, uint8,
smb_size + num_words*2 + num_bytes))) {
More information about the samba-cvs
mailing list