diff options
| author | Ralph Wuerthner <ralph.wuerthner@de.ibm.com> | 2013-04-04 13:29:01 +0200 |
|---|---|---|
| committer | Michael Adam <obnox@samba.org> | 2013-04-10 02:03:12 +0200 |
| commit | 8aae8b5bad167ac732b7f8949dfb40aebb2f26a9 (patch) | |
| tree | 3cc68c35066ad8676b32c93a2dcded6c7a46001e /source3/smbd/reply.c | |
| parent | a70e9db0f325e9be85983c172f0cc68992b0f593 (diff) | |
| download | samba-8aae8b5bad167ac732b7f8949dfb40aebb2f26a9.tar.gz samba-8aae8b5bad167ac732b7f8949dfb40aebb2f26a9.tar.bz2 samba-8aae8b5bad167ac732b7f8949dfb40aebb2f26a9.zip | |
s3:smbd: do not access data behind req->buf+req->buflen in srvstr_pull_req_talloc()
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Wed Apr 10 02:03:13 CEST 2013 on sn-devel-104
Diffstat (limited to 'source3/smbd/reply.c')
| -rw-r--r-- | source3/smbd/reply.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c index 274807beb9..79aaf76043 100644 --- a/source3/smbd/reply.c +++ b/source3/smbd/reply.c @@ -347,8 +347,14 @@ size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req, size_t srvstr_pull_req_talloc(TALLOC_CTX *ctx, struct smb_request *req, char **dest, const char *src, int flags) { + ssize_t bufrem = smbreq_bufrem(req, src); + + if (bufrem < 0) { + return 0; + } + return pull_string_talloc(ctx, req->inbuf, req->flags2, dest, src, - smbreq_bufrem(req, src), flags); + bufrem, flags); } /**************************************************************************** |