diff options
| author | Günther Deschner <gd@samba.org> | 2009-04-07 01:10:41 +0200 |
|---|---|---|
| committer | Günther Deschner <gd@samba.org> | 2009-04-07 01:16:30 +0200 |
| commit | 21b083a647997549e8188c6fc0687fdecfaa4cb3 (patch) | |
| tree | 6599c79d54ed13300cc71f6e62a2e6ba75920719 | |
| parent | 9d2d07503a17971a63153ecc13fdddb763e614b8 (diff) | |
| download | samba-21b083a647997549e8188c6fc0687fdecfaa4cb3.tar.gz samba-21b083a647997549e8188c6fc0687fdecfaa4cb3.tar.bz2 samba-21b083a647997549e8188c6fc0687fdecfaa4cb3.zip | |
s3-svcctl: Fix _svcctl_EnumServicesStatusW() crash bug on too small buffer.
Guenther
| -rw-r--r-- | source3/rpc_server/srv_svcctl_nt.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/source3/rpc_server/srv_svcctl_nt.c b/source3/rpc_server/srv_svcctl_nt.c index 3ca85aa755..848cdc25d0 100644 --- a/source3/rpc_server/srv_svcctl_nt.c +++ b/source3/rpc_server/srv_svcctl_nt.c @@ -468,9 +468,11 @@ WERROR _svcctl_EnumServicesStatusW(pipes_struct *p, } blob = ndr_push_blob(ndr); + if (blob.length >= r->in.buf_size) { + memcpy(r->out.service, blob.data, r->in.buf_size); + } } - r->out.service = blob.data; *r->out.bytes_needed = (buffer_size > r->in.buf_size) ? buffer_size : r->in.buf_size; *r->out.services_returned = (uint32)num_services; *r->out.resume_handle = 0x0; |