summaryrefslogtreecommitdiff
path: root/source3
diff options
context:
space:
mode:
authorGünther Deschner <gd@samba.org>2009-04-07 01:10:41 +0200
committerGünther Deschner <gd@samba.org>2009-04-07 01:16:30 +0200
commit21b083a647997549e8188c6fc0687fdecfaa4cb3 (patch)
tree6599c79d54ed13300cc71f6e62a2e6ba75920719 /source3
parent9d2d07503a17971a63153ecc13fdddb763e614b8 (diff)
downloadsamba-21b083a647997549e8188c6fc0687fdecfaa4cb3.tar.gz
samba-21b083a647997549e8188c6fc0687fdecfaa4cb3.tar.bz2
samba-21b083a647997549e8188c6fc0687fdecfaa4cb3.zip
s3-svcctl: Fix _svcctl_EnumServicesStatusW() crash bug on too small buffer.
Guenther
Diffstat (limited to 'source3')
-rw-r--r--source3/rpc_server/srv_svcctl_nt.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/source3/rpc_server/srv_svcctl_nt.c b/source3/rpc_server/srv_svcctl_nt.c
index 3ca85aa755..848cdc25d0 100644
--- a/source3/rpc_server/srv_svcctl_nt.c
+++ b/source3/rpc_server/srv_svcctl_nt.c
@@ -468,9 +468,11 @@ WERROR _svcctl_EnumServicesStatusW(pipes_struct *p,
}
blob = ndr_push_blob(ndr);
+ if (blob.length >= r->in.buf_size) {
+ memcpy(r->out.service, blob.data, r->in.buf_size);
+ }
}
- r->out.service = blob.data;
*r->out.bytes_needed = (buffer_size > r->in.buf_size) ? buffer_size : r->in.buf_size;
*r->out.services_returned = (uint32)num_services;
*r->out.resume_handle = 0x0;