summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorVolker Lendecke <vl@samba.org>2008-11-19 22:55:06 +0100
committerVolker Lendecke <vl@samba.org>2008-12-13 10:30:02 +0100
commitfd2bac966783a9aa3f278cc67219920384bc0981 (patch)
tree7185e222b23220fb177169457da97ce699c42ad9
parent3c66ba0b3cfe9114f28368c30305103ffec68f57 (diff)
downloadsamba-fd2bac966783a9aa3f278cc67219920384bc0981.tar.gz
samba-fd2bac966783a9aa3f278cc67219920384bc0981.tar.bz2
samba-fd2bac966783a9aa3f278cc67219920384bc0981.zip
For read&x replies, check the offset
-rw-r--r--source3/libsmb/clireadwrite.c19
1 files changed, 19 insertions, 0 deletions
diff --git a/source3/libsmb/clireadwrite.c b/source3/libsmb/clireadwrite.c
index ecf49396d1..1c2a0d56c4 100644
--- a/source3/libsmb/clireadwrite.c
+++ b/source3/libsmb/clireadwrite.c
@@ -109,6 +109,7 @@ NTSTATUS cli_read_andx_recv(struct async_req *req, ssize_t *received,
uint16_t *vwv;
uint16_t num_bytes;
uint8_t *bytes;
+ uint8_t *buf;
NTSTATUS status;
size_t size;
@@ -136,6 +137,24 @@ NTSTATUS cli_read_andx_recv(struct async_req *req, ssize_t *received,
return NT_STATUS_UNEXPECTED_IO_ERROR;
}
+ /*
+ * bcc field must be valid for small reads, for large reads the 16-bit
+ * bcc field can't be correct.
+ */
+
+ if ((size < 0xffff) && (size > num_bytes)) {
+ DEBUG(5, ("server announced more bytes than sent\n"));
+ return NT_STATUS_INVALID_NETWORK_RESPONSE;
+ }
+
+ buf = (uint8_t *)smb_base(cli_req->inbuf) + SVAL(vwv+6, 0);
+
+ if (trans_oob(smb_len(cli_req->inbuf), SVAL(vwv+6, 0), size)
+ || (buf < bytes)) {
+ DEBUG(5, ("server returned invalid read&x data offset\n"));
+ return NT_STATUS_INVALID_NETWORK_RESPONSE;
+ }
+
*rcvbuf = (uint8_t *)(smb_base(cli_req->inbuf) + SVAL(vwv + 6, 0));
*received = size;
return NT_STATUS_OK;