diff options
| author | Jeremy Allison <jra@samba.org> | 2007-04-03 04:52:09 +0000 |
|---|---|---|
| committer | Gerald (Jerry) Carter <jerry@samba.org> | 2007-10-10 12:19:06 -0500 |
| commit | afd637e926c70f9ca88d8e85ea2c684032962bc9 (patch) | |
| tree | 474511c0d30ece6ac597b14408511be69fd59b3e /source3/smbd/lanman.c | |
| parent | d2a57b63932496ba61ab2b9773eb959b6abaab8a (diff) | |
| download | samba-afd637e926c70f9ca88d8e85ea2c684032962bc9.tar.gz samba-afd637e926c70f9ca88d8e85ea2c684032962bc9.tar.bz2 samba-afd637e926c70f9ca88d8e85ea2c684032962bc9.zip | |
r22050: Fix a couple of off-by-one errors in the rap
call patch. Jerry, this works now for displaying
shares on Win9x (and hopefully everything else
as well :-).
Jeremy.
(This used to be commit 728a4cc71376f9cfff2578d21a47602f8b7c6531)
Diffstat (limited to 'source3/smbd/lanman.c')
| -rw-r--r-- | source3/smbd/lanman.c | 18 |
1 files changed, 15 insertions, 3 deletions
diff --git a/source3/smbd/lanman.c b/source3/smbd/lanman.c index 0ef6fe1c47..4ca9a4b051 100644 --- a/source3/smbd/lanman.c +++ b/source3/smbd/lanman.c @@ -2365,7 +2365,11 @@ static BOOL api_SetUserPassword(connection_struct *conn,uint16 vuid, memset(pass1,'\0',sizeof(pass1)); memset(pass2,'\0',sizeof(pass2)); - if (!is_offset_safe(param,tpscnt,p,32)) { + /* + * We use 31 here not 32 as we're checking + * the last byte we want to access is safe. + */ + if (!is_offset_safe(param,tpscnt,p,31)) { return False; } memcpy(pass1,p,16); @@ -2537,7 +2541,11 @@ static BOOL api_RDosPrintJobDel(connection_struct *conn,uint16 vuid, if (!str1 || !str2 || !p) { return False; } - if (!is_offset_safe(param,tpscnt,p,2)) { + /* + * We use 1 here not 2 as we're checking + * the last byte we want to access is safe. + */ + if (!is_offset_safe(param,tpscnt,p,1)) { return False; } if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid)) @@ -2701,7 +2709,11 @@ static BOOL api_PrintJobInfo(connection_struct *conn, uint16 vuid, if (!str1 || !str2 || !p) { return False; } - if (!is_offset_safe(param,tpscnt,p,2)) { + /* + * We use 1 here not 2 as we're checking + * the last byte we want to access is safe. + */ + if (!is_offset_safe(param,tpscnt,p,1)) { return False; } if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid)) |