svn commit: samba r24349 - in branches/SAMBA_3_2/source/smbd: .

vlendec at samba.org vlendec at samba.org
Sun Aug 12 12:15:34 GMT 2007


Author: vlendec
Date: 2007-08-12 12:15:32 +0000 (Sun, 12 Aug 2007)
New Revision: 24349

WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=24349

Log:
For large read&x we need more than 64k of outbuf.

Modified:
   branches/SAMBA_3_2/source/smbd/process.c


Changeset:
Modified: branches/SAMBA_3_2/source/smbd/process.c
===================================================================
--- branches/SAMBA_3_2/source/smbd/process.c	2007-08-12 11:40:27 UTC (rev 24348)
+++ branches/SAMBA_3_2/source/smbd/process.c	2007-08-12 12:15:32 UTC (rev 24349)
@@ -953,8 +953,19 @@
  allocate and initialize a reply packet
 ********************************************************************/
 
-void reply_outbuf(struct smb_request *req, uint8 num_words, uint16 num_bytes)
+void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
 {
+	/*
+         * Protect against integer wrap
+         */
+	if ((num_bytes > 0xffffff)
+	    || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
+		char *msg;
+		asprintf(&msg, "num_bytes too large: %u",
+			 (unsigned)num_bytes);
+		smb_panic(msg);
+	}
+
 	if (!(req->outbuf = TALLOC_ARRAY(
 		      req, uint8,
 		      smb_size + num_words*2 + num_bytes))) {



More information about the samba-cvs mailing list