diff options
| author | Jeremy Allison <jra@samba.org> | 2006-04-01 18:22:31 +0000 |
|---|---|---|
| committer | Gerald (Jerry) Carter <jerry@samba.org> | 2007-10-10 11:15:50 -0500 |
| commit | 872d3cea871264eed0159f49fba8621dd357ef1d (patch) | |
| tree | 2ae5e39b222570b4dfd9ed5cc7c322b46f63dc70 | |
| parent | ecc0c18889cb3d844310fb91130680df22663a31 (diff) | |
| download | samba-872d3cea871264eed0159f49fba8621dd357ef1d.tar.gz samba-872d3cea871264eed0159f49fba8621dd357ef1d.tar.bz2 samba-872d3cea871264eed0159f49fba8621dd357ef1d.zip | |
r14849: Fix >= that should be >. Too strict condition
checked by Volker.
Jeremy.
(This used to be commit 9a763da07385bf9af437cab8dd680f2e13fca3c3)
| -rw-r--r-- | source3/smbd/ipc.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c index 77746cb12f..427b6ae214 100644 --- a/source3/smbd/ipc.c +++ b/source3/smbd/ipc.c @@ -509,7 +509,7 @@ int reply_trans(connection_struct *conn, char *inbuf,char *outbuf, int size, int goto bad_param; if (pdisp > tpscnt) goto bad_param; - if ((smb_base(inbuf) + poff + pcnt >= inbuf + bufsize) || + if ((smb_base(inbuf) + poff + pcnt > inbuf + bufsize) || (smb_base(inbuf) + poff + pcnt < smb_base(inbuf))) goto bad_param; if (params + pdisp < params) @@ -525,7 +525,7 @@ int reply_trans(connection_struct *conn, char *inbuf,char *outbuf, int size, int goto bad_param; if (ddisp > tdscnt) goto bad_param; - if ((smb_base(inbuf) + doff + dcnt >= inbuf + bufsize) || + if ((smb_base(inbuf) + doff + dcnt > inbuf + bufsize) || (smb_base(inbuf) + doff + dcnt < smb_base(inbuf))) goto bad_param; if (data + ddisp < data) |