diff options
| author | Gerald Carter <jerry@samba.org> | 2003-10-30 15:57:52 +0000 |
|---|---|---|
| committer | Gerald Carter <jerry@samba.org> | 2003-10-30 15:57:52 +0000 |
| commit | 057c031d06a4c58a6a66fc71ea8c33f9b0913a0a (patch) | |
| tree | 1610650e715c8ea2ad9122bd81418449b230d2f6 | |
| parent | b7d72a3ce9b6c3a5f643a8610d5a8f2d7c575e35 (diff) | |
| download | samba-057c031d06a4c58a6a66fc71ea8c33f9b0913a0a.tar.gz samba-057c031d06a4c58a6a66fc71ea8c33f9b0913a0a.tar.bz2 samba-057c031d06a4c58a6a66fc71ea8c33f9b0913a0a.zip | |
bug 696; check for an invalid fid before dereferencing the fsp pointer
(This used to be commit f5229d5d62510f981bd08ad8139675b50421e042)
| -rw-r--r-- | source3/smbd/trans2.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c index 394adeeb6f..56d1aae3a2 100644 --- a/source3/smbd/trans2.c +++ b/source3/smbd/trans2.c @@ -3319,7 +3319,12 @@ static int call_trans2ioctl(connection_struct *conn, char* inbuf, { char *pdata = *ppdata; files_struct *fsp = file_fsp(inbuf,smb_vwv15); + + /* check for an invalid fid before proceeding */ + if (!fsp) + return(ERROR_DOS(ERRDOS,ERRbadfid)); + if ((SVAL(inbuf,(smb_setup+4)) == LMCAT_SPL) && (SVAL(inbuf,(smb_setup+6)) == LMFUNC_GETJOBID)) { pdata = Realloc(*ppdata, 32); |