diff options
| author | Jeremy Allison <jra@samba.org> | 2004-11-10 19:34:50 +0000 |
|---|---|---|
| committer | Gerald (Jerry) Carter <jerry@samba.org> | 2007-10-10 10:53:12 -0500 |
| commit | 70696e4c1c6ac475c8feafdf22cf799b2ea16ec8 (patch) | |
| tree | c08566058cf62a308e3607352900ccd5f06b1338 /source3/smbd/trans2.c | |
| parent | 314a601274ab6d1c2c8b064a413d9c463095b65a (diff) | |
| download | samba-70696e4c1c6ac475c8feafdf22cf799b2ea16ec8.tar.gz samba-70696e4c1c6ac475c8feafdf22cf799b2ea16ec8.tar.bz2 samba-70696e4c1c6ac475c8feafdf22cf799b2ea16ec8.zip | |
r3663: Fix too tight checking of incoming secondary trans2 requests.
Found by Stefan Esser <s.esser@e-matters.de>.
Jeremy.
(This used to be commit 44132c39ecbf055b897b1aa7bfca4eb1731badbf)
Diffstat (limited to 'source3/smbd/trans2.c')
| -rw-r--r-- | source3/smbd/trans2.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c index 4c0d5731eb..ca2c8a060d 100644 --- a/source3/smbd/trans2.c +++ b/source3/smbd/trans2.c @@ -4161,7 +4161,7 @@ int reply_trans2(connection_struct *conn, goto bad_param; if (num_params) { - if (param_disp + num_params >= total_params) + if (param_disp + num_params > total_params) goto bad_param; if ((param_disp + num_params < param_disp) || (param_disp + num_params < num_params)) @@ -4177,7 +4177,7 @@ int reply_trans2(connection_struct *conn, memcpy( ¶ms[param_disp], smb_base(inbuf) + param_off, num_params); } if (num_data) { - if (data_disp + num_data >= total_data) + if (data_disp + num_data > total_data) goto bad_param; if ((data_disp + num_data < data_disp) || (data_disp + num_data < num_data)) |