summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJeremy Allison <jra@samba.org>2007-12-04 12:53:21 -0800
committerJeremy Allison <jra@samba.org>2007-12-04 12:53:21 -0800
commit0e9a1c24a067832b2d3962e851001767973643d8 (patch)
tree480aecc1d12d9bfe06814cc0ca23ba11f2bf1f28
parent3ab73eab49547a0cb9d1c6d180460b8c79cf7037 (diff)
downloadsamba-0e9a1c24a067832b2d3962e851001767973643d8.tar.gz
samba-0e9a1c24a067832b2d3962e851001767973643d8.tar.bz2
samba-0e9a1c24a067832b2d3962e851001767973643d8.zip
Fix crash bug with vl's new trans handling in old transs
calls. Make this look like the (working) transs2 handling (replace inbuf, not write to outbuf - outbuf isn't allocated yet so you get a null deref). Jeremy. (This used to be commit f04e37a630f8e7538d670d34db4ea7fc7c0b50a3)
-rw-r--r--source3/smbd/ipc.c11
1 files changed, 6 insertions, 5 deletions
diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c
index 0360417c56..eed293d50d 100644
--- a/source3/smbd/ipc.c
+++ b/source3/smbd/ipc.c
@@ -752,7 +752,7 @@ void reply_transs(connection_struct *conn, struct smb_request *req)
goto bad_param;
memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,
- dcnt);
+ dcnt);
}
if ((state->received_param < state->total_param) ||
@@ -761,10 +761,11 @@ void reply_transs(connection_struct *conn, struct smb_request *req)
return;
}
- /* construct_reply_common has done us the favor to pre-fill the
- * command field with SMBtranss which is wrong :-)
- */
- SCVAL(req->outbuf,smb_com,SMBtrans);
+ /*
+ * construct_reply_common will copy smb_com from inbuf to
+ * outbuf. SMBtranss is wrong here.
+ */
+ SCVAL(req->inbuf,smb_com,SMBtrans);
handle_trans(conn, req, state);