diff options
| author | Günther Deschner <gd@samba.org> | 2008-02-04 11:28:15 +0100 |
|---|---|---|
| committer | Günther Deschner <gd@samba.org> | 2008-02-04 11:28:15 +0100 |
| commit | 72ea99a0aa7ce9ffe0043c27d0d9cd466ec60e26 (patch) | |
| tree | 9b7d95e8fe3db91945df28916bbf2129171a1825 /source3 | |
| parent | 1b05c213ecf1a6eb48d3086049680c9be12d88c8 (diff) | |
| download | samba-72ea99a0aa7ce9ffe0043c27d0d9cd466ec60e26.tar.gz samba-72ea99a0aa7ce9ffe0043c27d0d9cd466ec60e26.tar.bz2 samba-72ea99a0aa7ce9ffe0043c27d0d9cd466ec60e26.zip | |
Re-run make idl.
Guenther
(This used to be commit c56b702454c82b7aa7debbfc7f270b2d2b10226d)
Diffstat (limited to 'source3')
| -rw-r--r-- | source3/librpc/gen_ndr/eventlog.h | 2 | ||||
| -rw-r--r-- | source3/librpc/gen_ndr/ndr_eventlog.c | 3 |
2 files changed, 4 insertions, 1 deletions
diff --git a/source3/librpc/gen_ndr/eventlog.h b/source3/librpc/gen_ndr/eventlog.h index e067a2bdd3..0fd929dd99 100644 --- a/source3/librpc/gen_ndr/eventlog.h +++ b/source3/librpc/gen_ndr/eventlog.h @@ -164,7 +164,7 @@ struct eventlog_ReadEventLogW { struct policy_handle *handle;/* [ref] */ uint32_t flags; uint32_t offset; - uint32_t number_of_bytes; + uint32_t number_of_bytes;/* [range(0,0x7FFFF)] */ } in; struct { diff --git a/source3/librpc/gen_ndr/ndr_eventlog.c b/source3/librpc/gen_ndr/ndr_eventlog.c index ef76616c8b..442c40bb80 100644 --- a/source3/librpc/gen_ndr/ndr_eventlog.c +++ b/source3/librpc/gen_ndr/ndr_eventlog.c @@ -874,6 +874,9 @@ static enum ndr_err_code ndr_pull_eventlog_ReadEventLogW(struct ndr_pull *ndr, i NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.flags)); NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.offset)); NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.number_of_bytes)); + if (r->in.number_of_bytes < 0 || r->in.number_of_bytes > 0x7FFFF) { + return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range"); + } NDR_PULL_ALLOC_N(ndr, r->out.data, r->in.number_of_bytes); memset(r->out.data, 0, r->in.number_of_bytes * sizeof(*r->out.data)); NDR_PULL_ALLOC(ndr, r->out.sent_size); |