summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJeremy Allison <jra@samba.org>2004-11-10 19:34:50 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 10:53:12 -0500
commit70696e4c1c6ac475c8feafdf22cf799b2ea16ec8 (patch)
treec08566058cf62a308e3607352900ccd5f06b1338
parent314a601274ab6d1c2c8b064a413d9c463095b65a (diff)
downloadsamba-70696e4c1c6ac475c8feafdf22cf799b2ea16ec8.tar.gz
samba-70696e4c1c6ac475c8feafdf22cf799b2ea16ec8.tar.bz2
samba-70696e4c1c6ac475c8feafdf22cf799b2ea16ec8.zip
r3663: Fix too tight checking of incoming secondary trans2 requests.
Found by Stefan Esser <s.esser@e-matters.de>. Jeremy. (This used to be commit 44132c39ecbf055b897b1aa7bfca4eb1731badbf)
-rw-r--r--source3/smbd/trans2.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
index 4c0d5731eb..ca2c8a060d 100644
--- a/source3/smbd/trans2.c
+++ b/source3/smbd/trans2.c
@@ -4161,7 +4161,7 @@ int reply_trans2(connection_struct *conn,
goto bad_param;
if (num_params) {
- if (param_disp + num_params >= total_params)
+ if (param_disp + num_params > total_params)
goto bad_param;
if ((param_disp + num_params < param_disp) ||
(param_disp + num_params < num_params))
@@ -4177,7 +4177,7 @@ int reply_trans2(connection_struct *conn,
memcpy( &params[param_disp], smb_base(inbuf) + param_off, num_params);
}
if (num_data) {
- if (data_disp + num_data >= total_data)
+ if (data_disp + num_data > total_data)
goto bad_param;
if ((data_disp + num_data < data_disp) ||
(data_disp + num_data < num_data))