summaryrefslogtreecommitdiff
path: root/source3/smbd
diff options
context:
space:
mode:
authorVolker Lendecke <vl@samba.org>2008-11-08 17:14:06 +0100
committerVolker Lendecke <vl@samba.org>2008-11-27 17:19:01 +0100
commit114f519233cd37bfd623db820e888469c75fab26 (patch)
treef349bd5d80d428d51f6b15ea19fb38feda99a825 /source3/smbd
parent58db2befbd82b8e1e7cb7de29da7f567dea314e9 (diff)
downloadsamba-114f519233cd37bfd623db820e888469c75fab26.tar.gz
samba-114f519233cd37bfd623db820e888469c75fab26.tar.bz2
samba-114f519233cd37bfd623db820e888469c75fab26.zip
Fix the offset checks in the trans routines
This fixes a potential crash bug, a client can make us read memory we should not read. Luckily I got the disp checks right... Volker (cherry picked from commit 64a1d80851da5b05e70ec6c96f6e9bd473748369) (cherry picked from commit f04c5650a3aeca23591ddc781c4b297caaf9bb3f)
Diffstat (limited to 'source3/smbd')
-rw-r--r--source3/smbd/ipc.c6
-rw-r--r--source3/smbd/nttrans.c6
-rw-r--r--source3/smbd/trans2.c6
3 files changed, 9 insertions, 9 deletions
diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c
index 26a4212ec9..a617756a53 100644
--- a/source3/smbd/ipc.c
+++ b/source3/smbd/ipc.c
@@ -769,10 +769,10 @@ void reply_transs(struct smb_request *req)
goto bad_param;
}
- if (ddisp > av_size ||
+ if (doff > av_size ||
dcnt > av_size ||
- ddisp+dcnt > av_size ||
- ddisp+dcnt < ddisp) {
+ doff+dcnt > av_size ||
+ doff+dcnt < doff) {
goto bad_param;
}
diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c
index 8a18c87903..329ba23ddd 100644
--- a/source3/smbd/nttrans.c
+++ b/source3/smbd/nttrans.c
@@ -2818,10 +2818,10 @@ void reply_nttranss(struct smb_request *req)
goto bad_param;
}
- if (ddisp > av_size ||
+ if (doff > av_size ||
dcnt > av_size ||
- ddisp+dcnt > av_size ||
- ddisp+dcnt < ddisp) {
+ doff+dcnt > av_size ||
+ doff+dcnt < doff) {
goto bad_param;
}
diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
index c385c6ccb1..0c63588ccc 100644
--- a/source3/smbd/trans2.c
+++ b/source3/smbd/trans2.c
@@ -7811,10 +7811,10 @@ void reply_transs2(struct smb_request *req)
goto bad_param;
}
- if (ddisp > av_size ||
+ if (doff > av_size ||
dcnt > av_size ||
- ddisp+dcnt > av_size ||
- ddisp+dcnt < ddisp) {
+ doff+dcnt > av_size ||
+ doff+dcnt < doff) {
goto bad_param;
}