diff options
| author | Volker Lendecke <vl@samba.org> | 2008-11-19 22:55:06 +0100 |
|---|---|---|
| committer | Volker Lendecke <vl@samba.org> | 2008-12-13 10:30:02 +0100 |
| commit | fd2bac966783a9aa3f278cc67219920384bc0981 (patch) | |
| tree | 7185e222b23220fb177169457da97ce699c42ad9 | |
| parent | 3c66ba0b3cfe9114f28368c30305103ffec68f57 (diff) | |
| download | samba-fd2bac966783a9aa3f278cc67219920384bc0981.tar.gz samba-fd2bac966783a9aa3f278cc67219920384bc0981.tar.bz2 samba-fd2bac966783a9aa3f278cc67219920384bc0981.zip | |
For read&x replies, check the offset
| -rw-r--r-- | source3/libsmb/clireadwrite.c | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/source3/libsmb/clireadwrite.c b/source3/libsmb/clireadwrite.c index ecf49396d1..1c2a0d56c4 100644 --- a/source3/libsmb/clireadwrite.c +++ b/source3/libsmb/clireadwrite.c @@ -109,6 +109,7 @@ NTSTATUS cli_read_andx_recv(struct async_req *req, ssize_t *received, uint16_t *vwv; uint16_t num_bytes; uint8_t *bytes; + uint8_t *buf; NTSTATUS status; size_t size; @@ -136,6 +137,24 @@ NTSTATUS cli_read_andx_recv(struct async_req *req, ssize_t *received, return NT_STATUS_UNEXPECTED_IO_ERROR; } + /* + * bcc field must be valid for small reads, for large reads the 16-bit + * bcc field can't be correct. + */ + + if ((size < 0xffff) && (size > num_bytes)) { + DEBUG(5, ("server announced more bytes than sent\n")); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + buf = (uint8_t *)smb_base(cli_req->inbuf) + SVAL(vwv+6, 0); + + if (trans_oob(smb_len(cli_req->inbuf), SVAL(vwv+6, 0), size) + || (buf < bytes)) { + DEBUG(5, ("server returned invalid read&x data offset\n")); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + *rcvbuf = (uint8_t *)(smb_base(cli_req->inbuf) + SVAL(vwv + 6, 0)); *received = size; return NT_STATUS_OK; |