diff options
| author | Günther Deschner <gd@samba.org> | 2009-04-14 12:08:55 +0200 |
|---|---|---|
| committer | Günther Deschner <gd@samba.org> | 2009-04-14 12:13:24 +0200 |
| commit | fa302020ee39bf39bf324983cf8e381232691e76 (patch) | |
| tree | 8ea2f904098b65339c808168d007076354cf7218 | |
| parent | e3ceb0c65333cb870463971021e3af24d82abf26 (diff) | |
| download | samba-fa302020ee39bf39bf324983cf8e381232691e76.tar.gz samba-fa302020ee39bf39bf324983cf8e381232691e76.tar.bz2 samba-fa302020ee39bf39bf324983cf8e381232691e76.zip | |
s3-svcctl: fix memcpy in _svcctl_EnumServicesStatusW().
Make sure we are not copying more than what we have as valid data.
Fix from Jeremy. Thanks a lot for watching this so closely!
Guenther
| -rw-r--r-- | source3/rpc_server/srv_svcctl_nt.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/source3/rpc_server/srv_svcctl_nt.c b/source3/rpc_server/srv_svcctl_nt.c index 0b0ef83bee..d73f73f9ec 100644 --- a/source3/rpc_server/srv_svcctl_nt.c +++ b/source3/rpc_server/srv_svcctl_nt.c @@ -464,9 +464,8 @@ WERROR _svcctl_EnumServicesStatusW(pipes_struct *p, if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { return ntstatus_to_werror(ndr_map_error2ntstatus(ndr_err)); } - blob = ndr_push_blob(ndr); - memcpy(r->out.service, blob.data, r->in.offered); + memcpy(r->out.service, blob.data, MIN(blob.length, r->in.offered)); } *r->out.needed = (buffer_size > r->in.offered) ? buffer_size : r->in.offered; |