[SCM] Samba Shared Repository - branch v3-2-test updated - initial-v3-2-unstable-639-gc9496e9

[Jeremy Allison]

The branch, v3-2-test has been updated
       via  c9496e97cf91c5f29f19c123377f03f44d1a32f6 (commit)
       via  6b1246c29a0241c8e4bb98d659d847d010826b36 (commit)
      from  da23684261f40c06dea30ab2df0c878ebb0d0d81 (commit)

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-2-test


- Log -----------------------------------------------------------------
commit c9496e97cf91c5f29f19c123377f03f44d1a32f6
Merge: 6b1246c29a0241c8e4bb98d659d847d010826b36 da23684261f40c06dea30ab2df0c878ebb0d0d81
Author: Jeremy Allison <jra at samba.org>
Date:   Thu Dec 13 16:46:42 2007 -0800

    Merge branch 'v3-2-test' of ssh://jra@git.samba.org/data/git/samba into v3-2-test

commit 6b1246c29a0241c8e4bb98d659d847d010826b36
Author: Jeremy Allison <jra at samba.org>
Date:   Thu Dec 13 16:44:24 2007 -0800

    Arg. The fix for CVE-2007-6015 hadn't been merged into 3.2.
    Do so now....
    Jeremy.

-----------------------------------------------------------------------

Summary of changes:
 source/libsmb/clidgram.c   |    6 ++++++
 source/nmbd/nmbd_packets.c |    6 ++++++
 2 files changed, 12 insertions(+), 0 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source/libsmb/clidgram.c b/source/libsmb/clidgram.c
index 82f874f..76630bd 100644
--- a/source/libsmb/clidgram.c
+++ b/source/libsmb/clidgram.c
@@ -75,6 +75,12 @@ bool cli_send_mailslot(struct messaging_context *msg_ctx,
 	/* Setup the smb part. */
 	ptr -= 4; /* XXX Ugliness because of handling of tcp SMB length. */
 	memcpy(tmp,ptr,4);
+
+	if (smb_size + 17*2 + strlen(mailslot) + 1 + len > MAX_DGRAM_SIZE) {
+		DEBUG(0, ("cli_send_mailslot: Cannot write beyond end of packet\n"));
+		return False;
+	}
+
 	set_message(ptr,17,strlen(mailslot) + 1 + len,True);
 	memcpy(ptr,tmp,4);
 
diff --git a/source/nmbd/nmbd_packets.c b/source/nmbd/nmbd_packets.c
index b78ab5b..349d36c 100644
--- a/source/nmbd/nmbd_packets.c
+++ b/source/nmbd/nmbd_packets.c
@@ -1918,6 +1918,12 @@ bool send_mailslot(bool unique, const char *mailslot,char *buf, size_t len,
 	/* Setup the smb part. */
 	ptr -= 4; /* XXX Ugliness because of handling of tcp SMB length. */
 	memcpy(tmp,ptr,4);
+
+	if (smb_size + 17*2 + strlen(mailslot) + 1 + len > MAX_DGRAM_SIZE) {
+		DEBUG(0, ("send_mailslot: Cannot write beyond end of packet\n"));
+		return false;
+	}
+
 	set_message(ptr,17,strlen(mailslot) + 1 + len,True);
 	memcpy(ptr,tmp,4);
 


-- 
Samba Shared Repository