(Fixed) Final part of fix for bug #5953 - smbclient crashes: cli_list_new segmentation fault (with NAS-BASIC server).

1 files changed, 5 insertions, 4 deletions

diff --git a/source3/libsmb/clilist.c b/source3/libsmb/clilist.c
index cebafc6919..1431b804b0 100644
--- a/source3/libsmb/clilist.c
+++ b/source3/libsmb/clilist.c
@@ -79,16 +79,17 @@ static size_t interpret_long_filename(TALLOC_CTX *ctx,
 			p += 27;
 			p += clistr_align_in(cli, p, 0);
 
-			/* We can safely use +1 here (which is required by OS/2)
-			 * instead of +2 as the STR_TERMINATE flag below is
+			/* We can safely use len here (which is required by OS/2)
+			 * and the NAS-BASIC server instead of +2 or +1 as the
+			 * STR_TERMINATE flag below is
 			 * actually used as the length calculation.
-			 * The len+2 is merely an upper bound.
+			 * The len is merely an upper bound.
 			 * Due to the explicit 2 byte null termination
 			 * in cli_receive_trans/cli_receive_nt_trans
 			 * we know this is safe. JRA + kukks
 			 */
 
-			if (p + len + 1 > pdata_end) {
+			if (p + len > pdata_end) {
 				return pdata_end - base;
 			}