summaryrefslogtreecommitdiff
path: root/source3
diff options
context:
space:
mode:
authorJeremy Allison <jra@samba.org>2007-11-20 15:31:18 -0800
committerJeremy Allison <jra@samba.org>2007-11-20 15:31:18 -0800
commit61b37c73eeff8548c63df76e7d650c27746ca720 (patch)
tree08f1d3c8fad2cdeba88a391067816a7dc87b1163 /source3
parent2545457268610ab8fe71911bab167b4aeebc4ca3 (diff)
downloadsamba-61b37c73eeff8548c63df76e7d650c27746ca720.tar.gz
samba-61b37c73eeff8548c63df76e7d650c27746ca720.tar.bz2
samba-61b37c73eeff8548c63df76e7d650c27746ca720.zip
Paranoia check that space_remaining never goes -ve.
Jeremy. (This used to be commit 76f9c0b2dccffbff7cbf98aa63f50b48ad7cb9cb)
Diffstat (limited to 'source3')
-rw-r--r--source3/smbd/trans2.c12
1 files changed, 10 insertions, 2 deletions
diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
index bb24db9ee1..323d78cde1 100644
--- a/source3/smbd/trans2.c
+++ b/source3/smbd/trans2.c
@@ -1371,7 +1371,9 @@ static bool get_lanman2_dir_entry(TALLOC_CTX *ctx,
SSVAL(p,20,mode);
p += 23;
nameptr = p;
- p += align_string(pdata, p, 0);
+ if (flags2 & FLAGS2_UNICODE_STRINGS) {
+ p += ucs2_align(base_data, p, 0);
+ }
len = srvstr_push(base_data, flags2, p,
fname, PTR_DIFF(end_data, p),
STR_TERMINATE);
@@ -2022,7 +2024,13 @@ total_data=%u (should be %u)\n", (unsigned int)total_data, (unsigned int)IVAL(pd
if(got_exact_match)
finished = True;
- space_remaining = max_data_bytes - PTR_DIFF(p,pdata);
+ /* Ensure space_remaining never goes -ve. */
+ if (PTR_DIFF(p,pdata) > max_data_bytes) {
+ space_remaining = 0;
+ out_of_space = true;
+ } else {
+ space_remaining = max_data_bytes - PTR_DIFF(p,pdata);
+ }
}
/* Check if we can close the dirptr */