[SCM] Samba Shared Repository - branch master updated -
release-4-0-0alpha7-884-g21b083a
Günther Deschner
gd at samba.org
Mon Apr 6 23:17:09 GMT 2009
The branch, master has been updated
via 21b083a647997549e8188c6fc0687fdecfaa4cb3 (commit)
from 9d2d07503a17971a63153ecc13fdddb763e614b8 (commit)
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 21b083a647997549e8188c6fc0687fdecfaa4cb3
Author: Günther Deschner <gd at samba.org>
Date: Tue Apr 7 01:10:41 2009 +0200
s3-svcctl: Fix _svcctl_EnumServicesStatusW() crash bug on too small buffer.
Guenther
-----------------------------------------------------------------------
Summary of changes:
source3/rpc_server/srv_svcctl_nt.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
Changeset truncated at 500 lines:
diff --git a/source3/rpc_server/srv_svcctl_nt.c b/source3/rpc_server/srv_svcctl_nt.c
index 3ca85aa..848cdc2 100644
--- a/source3/rpc_server/srv_svcctl_nt.c
+++ b/source3/rpc_server/srv_svcctl_nt.c
@@ -468,9 +468,11 @@ WERROR _svcctl_EnumServicesStatusW(pipes_struct *p,
}
blob = ndr_push_blob(ndr);
+ if (blob.length >= r->in.buf_size) {
+ memcpy(r->out.service, blob.data, r->in.buf_size);
+ }
}
- r->out.service = blob.data;
*r->out.bytes_needed = (buffer_size > r->in.buf_size) ? buffer_size : r->in.buf_size;
*r->out.services_returned = (uint32)num_services;
*r->out.resume_handle = 0x0;
--
Samba Shared Repository
More information about the samba-cvs
mailing list