[SCM] Samba Shared Repository - branch v3-2-test updated -
release-3-2-0pre2-3200-gf04c565
Karolin Seeger
kseeger at samba.org
Thu Nov 27 14:25:22 GMT 2008
The branch, v3-2-test has been updated
via f04c5650a3aeca23591ddc781c4b297caaf9bb3f (commit)
from ca172884bb9f64980d46d3e2cecd6189075cc983 (commit)
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-2-test
- Log -----------------------------------------------------------------
commit f04c5650a3aeca23591ddc781c4b297caaf9bb3f
Author: Volker Lendecke <vl at samba.org>
Date: Sat Nov 8 17:14:06 2008 +0100
Fix the offset checks in the trans routines
This fixes a potential crash bug, a client can make us read memory we
should not read. Luckily I got the disp checks right...
Volker
(cherry picked from commit 64a1d80851da5b05e70ec6c96f6e9bd473748369)
-----------------------------------------------------------------------
Summary of changes:
source/smbd/ipc.c | 6 +++---
source/smbd/nttrans.c | 6 +++---
source/smbd/trans2.c | 6 +++---
3 files changed, 9 insertions(+), 9 deletions(-)
Changeset truncated at 500 lines:
diff --git a/source/smbd/ipc.c b/source/smbd/ipc.c
index 6961a5c..a53bc5b 100644
--- a/source/smbd/ipc.c
+++ b/source/smbd/ipc.c
@@ -764,10 +764,10 @@ void reply_transs(struct smb_request *req)
goto bad_param;
}
- if (ddisp > av_size ||
+ if (doff > av_size ||
dcnt > av_size ||
- ddisp+dcnt > av_size ||
- ddisp+dcnt < ddisp) {
+ doff+dcnt > av_size ||
+ doff+dcnt < doff) {
goto bad_param;
}
diff --git a/source/smbd/nttrans.c b/source/smbd/nttrans.c
index 4457883..da7b2bf 100644
--- a/source/smbd/nttrans.c
+++ b/source/smbd/nttrans.c
@@ -2863,10 +2863,10 @@ void reply_nttranss(struct smb_request *req)
goto bad_param;
}
- if (ddisp > av_size ||
+ if (doff > av_size ||
dcnt > av_size ||
- ddisp+dcnt > av_size ||
- ddisp+dcnt < ddisp) {
+ doff+dcnt > av_size ||
+ doff+dcnt < doff) {
goto bad_param;
}
diff --git a/source/smbd/trans2.c b/source/smbd/trans2.c
index acc424f..c7edec1 100644
--- a/source/smbd/trans2.c
+++ b/source/smbd/trans2.c
@@ -7785,10 +7785,10 @@ void reply_transs2(struct smb_request *req)
goto bad_param;
}
- if (ddisp > av_size ||
+ if (doff > av_size ||
dcnt > av_size ||
- ddisp+dcnt > av_size ||
- ddisp+dcnt < ddisp) {
+ doff+dcnt > av_size ||
+ doff+dcnt < doff) {
goto bad_param;
}
--
Samba Shared Repository
More information about the samba-cvs
mailing list