Security fix for CVE-2008-1105: Boundary failure when parsing SMB responses

can result in a buffer overrun.
Jeremy.
(This used to be commit 23b825e9d2c74c5b940cf4d3aa56c18692259972)

1 files changed, 0 insertions, 100 deletions

diff --git a/source3/libsmb/clireadwrite.c b/source3/libsmb/clireadwrite.c
index 515471e003..057e647983 100644
--- a/source3/libsmb/clireadwrite.c
+++ b/source3/libsmb/clireadwrite.c
@@ -472,106 +472,6 @@ ssize_t cli_read(struct cli_state *cli, int fnum, char *buf,
 	return ret;
 }
 
-#if 0  /* relies on client_receive_smb(), now a static in libsmb/clientgen.c */
-
-/* This call is INCOMPATIBLE with SMB signing.  If you remove the #if 0
-   you must fix ensure you don't attempt to sign the packets - data
-   *will* be currupted */
-
-/****************************************************************************
-Issue a single SMBreadraw and don't wait for a reply.
-****************************************************************************/
-
-static bool cli_issue_readraw(struct cli_state *cli, int fnum, off_t offset, 
-			   size_t size, int i)
-{
-
-	if (!cli->sign_info.use_smb_signing) {
-		DEBUG(0, ("Cannot use readraw and SMB Signing\n"));
-		return False;
-	}
-	
-	memset(cli->outbuf,'\0',smb_size);
-	memset(cli->inbuf,'\0',smb_size);
-
-	cli_set_message(cli->outbuf,10,0,True);
-		
-	SCVAL(cli->outbuf,smb_com,SMBreadbraw);
-	SSVAL(cli->outbuf,smb_tid,cli->cnum);
-	cli_setup_packet(cli);
-
-	SSVAL(cli->outbuf,smb_vwv0,fnum);
-	SIVAL(cli->outbuf,smb_vwv1,offset);
-	SSVAL(cli->outbuf,smb_vwv2,size);
-	SSVAL(cli->outbuf,smb_vwv3,size);
-	SSVAL(cli->outbuf,smb_mid,cli->mid + i);
-
-	return cli_send_smb(cli);
-}
-
-/****************************************************************************
- Tester for the readraw call.
-****************************************************************************/
-
-ssize_t cli_readraw(struct cli_state *cli, int fnum, char *buf, off_t offset, size_t size)
-{
-	char *p;
-	int size2;
-	size_t readsize;
-	ssize_t total = 0;
-
-	if (size == 0) 
-		return 0;
-
-	/*
-	 * Set readsize to the maximum size we can handle in one readraw.
-	 */
-
-	readsize = 0xFFFF;
-
-	while (total < size) {
-		readsize = MIN(readsize, size-total);
-
-		/* Issue a read and receive a reply */
-
-		if (!cli_issue_readraw(cli, fnum, offset, readsize, 0))
-			return -1;
-
-		if (!client_receive_smb(cli->fd, cli->inbuf, cli->timeout))
-			return -1;
-
-		size2 = smb_len(cli->inbuf);
-
-		if (size2 > readsize) {
-			DEBUG(5,("server returned more than we wanted!\n"));
-			return -1;
-		} else if (size2 < 0) {
-			DEBUG(5,("read return < 0!\n"));
-			return -1;
-		}
-
-		/* Copy data into buffer */
-
-		if (size2) {
-			p = cli->inbuf + 4;
-			memcpy(buf + total, p, size2);
-		}
-
-		total += size2;
-		offset += size2;
-
-		/*
-		 * If the server returned less than we asked for we're at EOF.
-		 */
-
-		if (size2 < readsize)
-			break;
-	}
-
-	return total;
-}
-#endif
-
 /****************************************************************************
  Issue a single SMBwrite and don't wait for a reply.
 ****************************************************************************/