summaryrefslogtreecommitdiff
path: root/source3
diff options
context:
space:
mode:
authorJeremy Allison <jra@samba.org>2004-11-24 05:24:38 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 10:53:25 -0500
commit97bb32d61f825c524bd0e4caecce056088e13a6d (patch)
tree1a7fe3bdd46abd67608f2cf36f7a256502a63b93 /source3
parent44b5067e326fd26e5348495063045241d65293a5 (diff)
downloadsamba-97bb32d61f825c524bd0e4caecce056088e13a6d.tar.gz
samba-97bb32d61f825c524bd0e4caecce056088e13a6d.tar.bz2
samba-97bb32d61f825c524bd0e4caecce056088e13a6d.zip
r3936: Ensure LARGE_READX response must fit within reply buffer.
Jeremy. (This used to be commit 5541001cf98aa9afb8f98ebeb91561348d3f5d74)
Diffstat (limited to 'source3')
-rw-r--r--source3/smbd/reply.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 5d493d8716..a3bb412578 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -2186,6 +2186,12 @@ int reply_read_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
if (global_client_caps & CAP_LARGE_READX) {
smb_maxcnt |= ((((size_t)SVAL(inbuf,smb_vwv7)) & 1 )<<16);
+ if (smb_maxcnt > BUFFER_SIZE) {
+ DEBUG(0,("reply_read_and_X - read too large (%u) for reply buffer %u\n",
+ (unsigned int)smb_maxcnt, (unsigned int)BUFFER_SIZE));
+ END_PROFILE(SMBreadX);
+ return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+ }
}
if(CVAL(inbuf,smb_wct) == 12) {