diff options
| author | Jeremy Allison <jra@samba.org> | 2007-12-04 12:53:21 -0800 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2007-12-04 12:53:21 -0800 |
| commit | 0e9a1c24a067832b2d3962e851001767973643d8 (patch) | |
| tree | 480aecc1d12d9bfe06814cc0ca23ba11f2bf1f28 | |
| parent | 3ab73eab49547a0cb9d1c6d180460b8c79cf7037 (diff) | |
| download | samba-0e9a1c24a067832b2d3962e851001767973643d8.tar.gz samba-0e9a1c24a067832b2d3962e851001767973643d8.tar.bz2 samba-0e9a1c24a067832b2d3962e851001767973643d8.zip | |
Fix crash bug with vl's new trans handling in old transs
calls. Make this look like the (working) transs2 handling
(replace inbuf, not write to outbuf - outbuf isn't allocated
yet so you get a null deref).
Jeremy.
(This used to be commit f04e37a630f8e7538d670d34db4ea7fc7c0b50a3)
| -rw-r--r-- | source3/smbd/ipc.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c index 0360417c56..eed293d50d 100644 --- a/source3/smbd/ipc.c +++ b/source3/smbd/ipc.c @@ -752,7 +752,7 @@ void reply_transs(connection_struct *conn, struct smb_request *req) goto bad_param; memcpy(state->data+ddisp, smb_base(req->inbuf)+doff, - dcnt); + dcnt); } if ((state->received_param < state->total_param) || @@ -761,10 +761,11 @@ void reply_transs(connection_struct *conn, struct smb_request *req) return; } - /* construct_reply_common has done us the favor to pre-fill the - * command field with SMBtranss which is wrong :-) - */ - SCVAL(req->outbuf,smb_com,SMBtrans); + /* + * construct_reply_common will copy smb_com from inbuf to + * outbuf. SMBtranss is wrong here. + */ + SCVAL(req->inbuf,smb_com,SMBtrans); handle_trans(conn, req, state); |