diff options
| author | Jeremy Allison <jra@samba.org> | 2009-02-13 16:06:17 -0800 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2009-02-13 16:06:17 -0800 |
| commit | 49b52ec16f8150d71a0ebfdd0a7067981fe5840a (patch) | |
| tree | 7f6983695dedd88ab7402a2482f0e8feaafb7656 /source3/rpc_server/srv_pipe_hnd.c | |
| parent | f6821a15a05248f185bb6cdd1aeb588504f12d61 (diff) | |
| download | samba-49b52ec16f8150d71a0ebfdd0a7067981fe5840a.tar.gz samba-49b52ec16f8150d71a0ebfdd0a7067981fe5840a.tar.bz2 samba-49b52ec16f8150d71a0ebfdd0a7067981fe5840a.zip | |
Parameterize in local.h the MAX_RPC_DATA_SIZE, and ensure
that "offered" read from the rpc packet in spoolss is under
that size. Tidyup from analysis from Veracode.
Jeremy.
Diffstat (limited to 'source3/rpc_server/srv_pipe_hnd.c')
| -rw-r--r-- | source3/rpc_server/srv_pipe_hnd.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/source3/rpc_server/srv_pipe_hnd.c b/source3/rpc_server/srv_pipe_hnd.c index 0804af7ca9..6dead2d264 100644 --- a/source3/rpc_server/srv_pipe_hnd.c +++ b/source3/rpc_server/srv_pipe_hnd.c @@ -426,7 +426,7 @@ static bool process_request_pdu(pipes_struct *p, prs_struct *rpc_in_p) * will not fit in the initial buffer of size 0x1068 --jerry 22/01/2002 */ - if(prs_offset(&p->in_data.data) + data_len > 15*1024*1024) { + if(prs_offset(&p->in_data.data) + data_len > MAX_RPC_DATA_SIZE) { DEBUG(0,("process_request_pdu: rpc data buffer too large (%u) + (%u)\n", (unsigned int)prs_data_size(&p->in_data.data), (unsigned int)data_len )); set_incoming_fault(p); |