diff options
| author | Jeremy Allison <jra@samba.org> | 2003-10-29 21:27:57 +0000 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2003-10-29 21:27:57 +0000 |
| commit | 5ca824a682bbcd9331f32935f9b423ae6d468816 (patch) | |
| tree | 049e58740ad501eb0d888e98eac22006ff830250 /source3/libsmb | |
| parent | e893948e04136ed5b9ba08373a93dd55f81e2e24 (diff) | |
| download | samba-5ca824a682bbcd9331f32935f9b423ae6d468816.tar.gz samba-5ca824a682bbcd9331f32935f9b423ae6d468816.tar.bz2 samba-5ca824a682bbcd9331f32935f9b423ae6d468816.zip | |
Fixes to check for wraps which could cause coredumps.
Jeremy.
(This used to be commit 124a8ddae63adff4f601242a8e6d05abcaf4d9bf)
Diffstat (limited to 'source3/libsmb')
| -rw-r--r-- | source3/libsmb/clilist.c | 2 | ||||
| -rw-r--r-- | source3/libsmb/ntlmssp_parse.c | 7 |
2 files changed, 4 insertions, 5 deletions
diff --git a/source3/libsmb/clilist.c b/source3/libsmb/clilist.c index 7822987ada..2c1831ae99 100644 --- a/source3/libsmb/clilist.c +++ b/source3/libsmb/clilist.c @@ -82,7 +82,7 @@ static int interpret_long_filename(struct cli_state *cli, case 260: /* NT uses this, but also accepts 2 */ { - int namelen, slen; + size_t namelen, slen; p += 4; /* next entry offset */ p += 4; /* fileindex */ diff --git a/source3/libsmb/ntlmssp_parse.c b/source3/libsmb/ntlmssp_parse.c index 60cb4ab04a..b136dacf5a 100644 --- a/source3/libsmb/ntlmssp_parse.c +++ b/source3/libsmb/ntlmssp_parse.c @@ -226,7 +226,7 @@ BOOL msrpc_parse(const DATA_BLOB *blob, *ps = smb_xstrdup(""); } else { /* make sure its in the right format - be strict */ - if (len1 != len2 || ptr + len1 > blob->length) { + if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) { return False; } if (len1 & 1) { @@ -255,7 +255,7 @@ BOOL msrpc_parse(const DATA_BLOB *blob, if (len1 == 0 && len2 == 0) { *ps = smb_xstrdup(""); } else { - if (len1 != len2 || ptr + len1 > blob->length) { + if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) { return False; } @@ -280,7 +280,7 @@ BOOL msrpc_parse(const DATA_BLOB *blob, *b = data_blob(NULL, 0); } else { /* make sure its in the right format - be strict */ - if (len1 != len2 || ptr + len1 > blob->length) { + if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) { return False; } *b = data_blob(blob->data + ptr, len1); @@ -314,4 +314,3 @@ BOOL msrpc_parse(const DATA_BLOB *blob, return True; } - |