[SCM] Samba Shared Repository - branch v3-3-test updated - release-3-2-0pre2-4535-g5718a47

Karolin Seeger kseeger at samba.org
Thu Nov 27 14:28:09 GMT 2008


The branch, v3-3-test has been updated
       via  5718a4761af9b77ea17b64f12f1010c99f738c96 (commit)
      from  4bfe0e069983b1af050c2df6157b161e8ea572e9 (commit)

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-3-test


- Log -----------------------------------------------------------------
commit 5718a4761af9b77ea17b64f12f1010c99f738c96
Author: Volker Lendecke <vl at samba.org>
Date:   Sat Nov 8 17:14:06 2008 +0100

    Fix the offset checks in the trans routines
    
    This fixes a potential crash bug, a client can make us read memory we
    should not read. Luckily I got the disp checks right...
    
    Volker
    (cherry picked from commit 64a1d80851da5b05e70ec6c96f6e9bd473748369)
    (cherry picked from commit f04c5650a3aeca23591ddc781c4b297caaf9bb3f)

-----------------------------------------------------------------------

Summary of changes:
 source/smbd/ipc.c     |    6 +++---
 source/smbd/nttrans.c |    6 +++---
 source/smbd/trans2.c  |    6 +++---
 3 files changed, 9 insertions(+), 9 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source/smbd/ipc.c b/source/smbd/ipc.c
index a824ab7..ac5950e 100644
--- a/source/smbd/ipc.c
+++ b/source/smbd/ipc.c
@@ -767,10 +767,10 @@ void reply_transs(struct smb_request *req)
 			goto bad_param;
 		}
 
-		if (ddisp > av_size ||
+		if (doff > av_size ||
 				dcnt > av_size ||
-				ddisp+dcnt > av_size ||
-				ddisp+dcnt < ddisp) {
+				doff+dcnt > av_size ||
+				doff+dcnt < doff) {
 			goto bad_param;
 		}
 
diff --git a/source/smbd/nttrans.c b/source/smbd/nttrans.c
index c08b5ee..671b9e9 100644
--- a/source/smbd/nttrans.c
+++ b/source/smbd/nttrans.c
@@ -2817,10 +2817,10 @@ void reply_nttranss(struct smb_request *req)
 			goto bad_param;
 		}
 
-		if (ddisp > av_size ||
+		if (doff > av_size ||
 				dcnt > av_size ||
-				ddisp+dcnt > av_size ||
-				ddisp+dcnt < ddisp) {
+				doff+dcnt > av_size ||
+				doff+dcnt < doff) {
 			goto bad_param;
 		}
 
diff --git a/source/smbd/trans2.c b/source/smbd/trans2.c
index ad0554e..804fa21 100644
--- a/source/smbd/trans2.c
+++ b/source/smbd/trans2.c
@@ -7805,10 +7805,10 @@ void reply_transs2(struct smb_request *req)
 			goto bad_param;
 		}
 
-		if (ddisp > av_size ||
+		if (doff > av_size ||
 				dcnt > av_size ||
-				ddisp+dcnt > av_size ||
-				ddisp+dcnt < ddisp) {
+				doff+dcnt > av_size ||
+				doff+dcnt < doff) {
 			goto bad_param;
 		}
 


-- 
Samba Shared Repository


More information about the samba-cvs mailing list