summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorChristian Ambach <ambi@samba.org>2012-02-27 17:51:40 -0800
committerJeremy Allison <jra@samba.org>2012-03-09 16:48:16 -0800
commitf6afda0bc867f1080c45e1f6f79d5032c41d2b1a (patch)
treeb3d894270bad4a4e4165f95164dffef7d1497b37
parenteec5ece6f59c5ff30de88af0e182c3b2f7b9579c (diff)
downloadsamba-f6afda0bc867f1080c45e1f6f79d5032c41d2b1a.tar.gz
samba-f6afda0bc867f1080c45e1f6f79d5032c41d2b1a.tar.bz2
samba-f6afda0bc867f1080c45e1f6f79d5032c41d2b1a.zip
s3:smb2_server verify creditcharge
for all requests that have max_???? checks, also do a check of the creditcharge the client has sent (when using largemtu) Signed-off-by: Jeremy Allison <jra@samba.org>
-rw-r--r--source3/smbd/smb2_find.c8
-rw-r--r--source3/smbd/smb2_getinfo.c6
-rw-r--r--source3/smbd/smb2_notify.c7
-rw-r--r--source3/smbd/smb2_read.c5
-rw-r--r--source3/smbd/smb2_setinfo.c6
-rw-r--r--source3/smbd/smb2_write.c5
6 files changed, 37 insertions, 0 deletions
diff --git a/source3/smbd/smb2_find.c b/source3/smbd/smb2_find.c
index 99d3447860..9c0d18b278 100644
--- a/source3/smbd/smb2_find.c
+++ b/source3/smbd/smb2_find.c
@@ -282,6 +282,14 @@ static struct tevent_req *smbd_smb2_find_send(TALLOC_CTX *mem_ctx,
return tevent_req_post(req, ev);
}
+ status = smbd_smb2_request_verify_creditcharge(smb2req,
+ in_output_buffer_length);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+ return tevent_req_post(req, ev);
+ }
+
switch (in_file_info_class) {
case SMB2_FIND_DIRECTORY_INFO:
info_level = SMB_FIND_FILE_DIRECTORY_INFO;
diff --git a/source3/smbd/smb2_getinfo.c b/source3/smbd/smb2_getinfo.c
index 7d0f946898..e8d918df38 100644
--- a/source3/smbd/smb2_getinfo.c
+++ b/source3/smbd/smb2_getinfo.c
@@ -97,6 +97,12 @@ NTSTATUS smbd_smb2_request_process_getinfo(struct smbd_smb2_request *req)
return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
}
+ status = smbd_smb2_request_verify_creditcharge(req,
+ MAX(in_input_buffer.length,in_output_buffer_length));
+ if (!NT_STATUS_IS_OK(status)) {
+ return smbd_smb2_request_error(req, status);
+ }
+
if (req->compat_chain_fsp) {
/* skip check */
} else if (in_file_id_persistent != in_file_id_volatile) {
diff --git a/source3/smbd/smb2_notify.c b/source3/smbd/smb2_notify.c
index be56b18799..3f5365c154 100644
--- a/source3/smbd/smb2_notify.c
+++ b/source3/smbd/smb2_notify.c
@@ -77,6 +77,13 @@ NTSTATUS smbd_smb2_request_process_notify(struct smbd_smb2_request *req)
return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
}
+ status = smbd_smb2_request_verify_creditcharge(req,
+ in_output_buffer_length);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ return smbd_smb2_request_error(req, status);
+ }
+
if (req->compat_chain_fsp) {
/* skip check */
} else if (in_file_id_persistent != in_file_id_volatile) {
diff --git a/source3/smbd/smb2_read.c b/source3/smbd/smb2_read.c
index 13bcbdfd19..0b6e2ee461 100644
--- a/source3/smbd/smb2_read.c
+++ b/source3/smbd/smb2_read.c
@@ -80,6 +80,11 @@ NTSTATUS smbd_smb2_request_process_read(struct smbd_smb2_request *req)
return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
}
+ status = smbd_smb2_request_verify_creditcharge(req, in_length);
+ if (!NT_STATUS_IS_OK(status)) {
+ return smbd_smb2_request_error(req, status);
+ }
+
if (req->compat_chain_fsp) {
/* skip check */
} else if (in_file_id_persistent != in_file_id_volatile) {
diff --git a/source3/smbd/smb2_setinfo.c b/source3/smbd/smb2_setinfo.c
index ac6adc3d8f..be506ccecf 100644
--- a/source3/smbd/smb2_setinfo.c
+++ b/source3/smbd/smb2_setinfo.c
@@ -85,6 +85,12 @@ NTSTATUS smbd_smb2_request_process_setinfo(struct smbd_smb2_request *req)
return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
}
+ status = smbd_smb2_request_verify_creditcharge(req,
+ in_input_buffer.length);
+ if (!NT_STATUS_IS_OK(status)) {
+ return smbd_smb2_request_error(req, status);
+ }
+
if (req->compat_chain_fsp) {
/* skip check */
} else if (in_file_id_persistent != in_file_id_volatile) {
diff --git a/source3/smbd/smb2_write.c b/source3/smbd/smb2_write.c
index b0ffd44b49..163672cdb1 100644
--- a/source3/smbd/smb2_write.c
+++ b/source3/smbd/smb2_write.c
@@ -88,6 +88,11 @@ NTSTATUS smbd_smb2_request_process_write(struct smbd_smb2_request *req)
in_data_buffer.data = (uint8_t *)req->in.vector[i+2].iov_base;
in_data_buffer.length = in_data_length;
+ status = smbd_smb2_request_verify_creditcharge(req, in_data_length);
+ if (!NT_STATUS_IS_OK(status)) {
+ return smbd_smb2_request_error(req, status);
+ }
+
if (req->compat_chain_fsp) {
/* skip check */
} else if (in_file_id_persistent != in_file_id_volatile) {