summaryrefslogtreecommitdiff
path: root/source3/rpc_server
diff options
context:
space:
mode:
authorJeremy Allison <jra@samba.org>2010-02-09 14:48:15 -0800
committerJeremy Allison <jra@samba.org>2010-02-09 14:48:15 -0800
commit539bbf8653e0117dea139015b4b71be768e3f3d7 (patch)
tree053b0ec41a1f1e4eb65f7c0b3ae100c143ebf999 /source3/rpc_server
parent9ad6f432f3f5844b4b419e7cbaf3c3e70b052d29 (diff)
downloadsamba-539bbf8653e0117dea139015b4b71be768e3f3d7.tar.gz
samba-539bbf8653e0117dea139015b4b71be768e3f3d7.tar.bz2
samba-539bbf8653e0117dea139015b4b71be768e3f3d7.zip
Second part of fix for bug 7063 - Samba 3.4.5 on ubuntu 8.04 64 bit - Core dumps.
Ensure we have no naked memcpy calls. This isn't a crash bug (it's already checked in the data_blob_talloc_zero() above, but I want to get into the pattern of having all memcpy's covered by safety checks. Jeremy.
Diffstat (limited to 'source3/rpc_server')
-rw-r--r--source3/rpc_server/srv_spoolss_nt.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index e2e523d0de..33d47df33a 100644
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -9455,7 +9455,10 @@ WERROR _spoolss_XcvData(pipes_struct *p,
*r->out.status_code = 0;
- memcpy(r->out.out_data, out_data.data, out_data.length);
+ if (r->out.out_data && r->in.out_data_size && out_data.length) {
+ memcpy(r->out.out_data, out_data.data,
+ MIN(r->in.out_data_size, out_data.length));
+ }
return WERR_OK;
}