diff options
| author | Jeremy Allison <jra@samba.org> | 2002-08-27 14:16:37 +0000 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2002-08-27 14:16:37 +0000 |
| commit | 797af9369bd78b5ba0e121dd88c5d11f5341479f (patch) | |
| tree | 75c8729621c8d8a9c52010b72432559593423a10 | |
| parent | c53bbb55f67aacdd30cff7fb46064ce009d7794f (diff) | |
| download | samba-797af9369bd78b5ba0e121dd88c5d11f5341479f.tar.gz samba-797af9369bd78b5ba0e121dd88c5d11f5341479f.tar.bz2 samba-797af9369bd78b5ba0e121dd88c5d11f5341479f.zip | |
Ensure we have at least smb_size bytes before processing a packet.
Jeremy.
(This used to be commit 0385f7d7efed48fc8121fc0fbb433e9ca0954094)
| -rw-r--r-- | source3/smbd/process.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/source3/smbd/process.c b/source3/smbd/process.c index 372d96e79b..6b9e184afe 100644 --- a/source3/smbd/process.c +++ b/source3/smbd/process.c @@ -654,7 +654,7 @@ static int switch_message(int type,char *inbuf,char *outbuf,int size,int bufsize last_message = type; /* Make sure this is an SMB packet */ - if (strncmp(smb_base(inbuf),"\377SMB",4) != 0) { + if ((strncmp(smb_base(inbuf),"\377SMB",4) != 0) || (size - 4 < smb_size)) { DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",smb_len(inbuf))); exit_server("Non-SMB packet"); return(-1); |