summaryrefslogtreecommitdiff
path: root/source3/smbd
diff options
context:
space:
mode:
authorVolker Lendecke <vlendec@samba.org>2007-08-14 13:57:36 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 12:29:41 -0500
commita12e7ef30a45c155c0f211d02445ef0ad46acde0 (patch)
tree2dc1a68eed6b9bd8f3359084bb7abdba08cd887b /source3/smbd
parentec5b2a718192f5d5a26c44ff9c6714515d42ea47 (diff)
downloadsamba-a12e7ef30a45c155c0f211d02445ef0ad46acde0.tar.gz
samba-a12e7ef30a45c155c0f211d02445ef0ad46acde0.tar.bz2
samba-a12e7ef30a45c155c0f211d02445ef0ad46acde0.zip
r24409: Check wct in reply_open
(This used to be commit ee6f212ed0b332e6886056e6d254d0c0da7c5046)
Diffstat (limited to 'source3/smbd')
-rw-r--r--source3/smbd/reply.c10
1 files changed, 8 insertions, 2 deletions
diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 4a8ecb86e9..6acee164c6 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -1402,9 +1402,9 @@ int reply_open(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
int info;
SMB_STRUCT_STAT sbuf;
files_struct *fsp;
- int oplock_request = CORE_OPLOCK_REQUEST(inbuf);
+ int oplock_request;
int deny_mode;
- uint32 dos_attr = SVAL(inbuf,smb_vwv1);
+ uint32 dos_attr;
uint32 access_mask;
uint32 share_mode;
uint32 create_disposition;
@@ -1415,8 +1415,14 @@ int reply_open(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
START_PROFILE(SMBopen);
init_smb_request(&req, (uint8 *)inbuf);
+
+ if (req.wct < 2) {
+ return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+ }
+ oplock_request = CORE_OPLOCK_REQUEST(inbuf);
deny_mode = SVAL(inbuf,smb_vwv0);
+ dos_attr = SVAL(inbuf,smb_vwv1);
srvstr_get_path(inbuf, SVAL(inbuf,smb_flg2), fname, smb_buf(inbuf)+1,
sizeof(fname), 0, STR_TERMINATE, &status);