summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGünther Deschner <gd@samba.org>2009-04-14 12:08:55 +0200
committerGünther Deschner <gd@samba.org>2009-04-14 12:13:24 +0200
commitfa302020ee39bf39bf324983cf8e381232691e76 (patch)
tree8ea2f904098b65339c808168d007076354cf7218
parente3ceb0c65333cb870463971021e3af24d82abf26 (diff)
downloadsamba-fa302020ee39bf39bf324983cf8e381232691e76.tar.gz
samba-fa302020ee39bf39bf324983cf8e381232691e76.tar.bz2
samba-fa302020ee39bf39bf324983cf8e381232691e76.zip
s3-svcctl: fix memcpy in _svcctl_EnumServicesStatusW().
Make sure we are not copying more than what we have as valid data. Fix from Jeremy. Thanks a lot for watching this so closely! Guenther
-rw-r--r--source3/rpc_server/srv_svcctl_nt.c3
1 files changed, 1 insertions, 2 deletions
diff --git a/source3/rpc_server/srv_svcctl_nt.c b/source3/rpc_server/srv_svcctl_nt.c
index 0b0ef83bee..d73f73f9ec 100644
--- a/source3/rpc_server/srv_svcctl_nt.c
+++ b/source3/rpc_server/srv_svcctl_nt.c
@@ -464,9 +464,8 @@ WERROR _svcctl_EnumServicesStatusW(pipes_struct *p,
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
return ntstatus_to_werror(ndr_map_error2ntstatus(ndr_err));
}
-
blob = ndr_push_blob(ndr);
- memcpy(r->out.service, blob.data, r->in.offered);
+ memcpy(r->out.service, blob.data, MIN(blob.length, r->in.offered));
}
*r->out.needed = (buffer_size > r->in.offered) ? buffer_size : r->in.offered;