summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJeremy Allison <jra@samba.org>2007-11-01 22:24:39 -0700
committerJeremy Allison <jra@samba.org>2007-11-01 22:24:39 -0700
commitbece9609cd633d69c2c8dc72fcb6c26c4f11f9f2 (patch)
treee1943c16aca1dce654b26b4af7aa5116eba4402a
parentc94b2898cd5d1174181add198a462ab232f5aba6 (diff)
downloadsamba-bece9609cd633d69c2c8dc72fcb6c26c4f11f9f2.tar.gz
samba-bece9609cd633d69c2c8dc72fcb6c26c4f11f9f2.tar.bz2
samba-bece9609cd633d69c2c8dc72fcb6c26c4f11f9f2.zip
Be careful and take care of the correct lengths in large
writeX calls. Jeremy. (This used to be commit 2d3ff9c502105f92720131355b41e48be8d656c2)
-rw-r--r--source3/smbd/reply.c16
1 files changed, 7 insertions, 9 deletions
diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index d4f3f1f255..c83066d41e 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -3912,7 +3912,6 @@ void reply_write_and_X(connection_struct *conn, struct smb_request *req)
unsigned int smb_doff;
unsigned int smblen;
char *data;
- bool large_writeX;
NTSTATUS status;
START_PROFILE(SMBwriteX);
@@ -3926,12 +3925,11 @@ void reply_write_and_X(connection_struct *conn, struct smb_request *req)
numtowrite = SVAL(req->inbuf,smb_vwv10);
smb_doff = SVAL(req->inbuf,smb_vwv11);
smblen = smb_len(req->inbuf);
- large_writeX = (req->wct == 14 &&
- (smblen > 0xFFFF || req->unread_bytes > 0xFFFF));
- /* Deal with possible LARGE_WRITEX */
- if (large_writeX) {
- numtowrite |= ((((size_t)SVAL(req->inbuf,smb_vwv9)) & 1 )<<16);
+ if (req->unread_bytes > 0xFFFF ||
+ (smblen > smb_doff + 4 &&
+ smblen - smb_doff + 4 > 0xFFFF)) {
+ numtowrite |= (((size_t)SVAL(req->inbuf,smb_vwv9))<<16);
}
if (req->unread_bytes) {
@@ -3941,7 +3939,8 @@ void reply_write_and_X(connection_struct *conn, struct smb_request *req)
return;
}
} else {
- if (smb_doff > smblen || smb_doff + numtowrite > smblen) {
+ if (smb_doff + 4 > smblen || smb_doff + 4 + numtowrite < numtowrite ||
+ smb_doff + 4 + numtowrite > smblen) {
reply_doserror(req, ERRDOS, ERRbadmem);
END_PROFILE(SMBwriteX);
return;
@@ -4032,8 +4031,7 @@ void reply_write_and_X(connection_struct *conn, struct smb_request *req)
reply_outbuf(req, 6, 0);
SSVAL(req->outbuf,smb_vwv2,nwritten);
- if (large_writeX)
- SSVAL(req->outbuf,smb_vwv4,(nwritten>>16)&1);
+ SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
if (nwritten < (ssize_t)numtowrite) {
SCVAL(req->outbuf,smb_rcls,ERRHRD);