summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRalph Wuerthner <ralph.wuerthner@de.ibm.com>2013-04-04 13:29:01 +0200
committerMichael Adam <obnox@samba.org>2013-04-10 02:03:12 +0200
commit8aae8b5bad167ac732b7f8949dfb40aebb2f26a9 (patch)
tree3cc68c35066ad8676b32c93a2dcded6c7a46001e
parenta70e9db0f325e9be85983c172f0cc68992b0f593 (diff)
downloadsamba-8aae8b5bad167ac732b7f8949dfb40aebb2f26a9.tar.gz
samba-8aae8b5bad167ac732b7f8949dfb40aebb2f26a9.tar.bz2
samba-8aae8b5bad167ac732b7f8949dfb40aebb2f26a9.zip
s3:smbd: do not access data behind req->buf+req->buflen in srvstr_pull_req_talloc()
Reviewed-by: Volker Lendecke <vl@samba.org> Reviewed-by: Michael Adam <obnox@samba.org> Autobuild-User(master): Michael Adam <obnox@samba.org> Autobuild-Date(master): Wed Apr 10 02:03:13 CEST 2013 on sn-devel-104
-rw-r--r--source3/smbd/reply.c8
1 files changed, 7 insertions, 1 deletions
diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 274807beb9..79aaf76043 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -347,8 +347,14 @@ size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
size_t srvstr_pull_req_talloc(TALLOC_CTX *ctx, struct smb_request *req,
char **dest, const char *src, int flags)
{
+ ssize_t bufrem = smbreq_bufrem(req, src);
+
+ if (bufrem < 0) {
+ return 0;
+ }
+
return pull_string_talloc(ctx, req->inbuf, req->flags2, dest, src,
- smbreq_bufrem(req, src), flags);
+ bufrem, flags);
}
/****************************************************************************