summaryrefslogtreecommitdiff
path: root/source4/libcli
diff options
context:
space:
mode:
authorAndrew Tridgell <tridge@samba.org>2005-06-30 01:34:53 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 13:18:57 -0500
commit1050a54a3bb125af401f27cf0eb5a0ab51b085ea (patch)
tree0e9af0686ef1a9dc167a406658479b0c5862f55c /source4/libcli
parentc58c7c416412fd2ae90427f500b2d94996c36c48 (diff)
downloadsamba-1050a54a3bb125af401f27cf0eb5a0ab51b085ea.tar.gz
samba-1050a54a3bb125af401f27cf0eb5a0ab51b085ea.tar.bz2
samba-1050a54a3bb125af401f27cf0eb5a0ab51b085ea.zip
r8003: ensure that we don't try to send a trans request with more than 64k data or params
(This used to be commit b4f2d17ace6a609ec87da103a89e36edee8903f9)
Diffstat (limited to 'source4/libcli')
-rw-r--r--source4/libcli/raw/rawtrans.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/source4/libcli/raw/rawtrans.c b/source4/libcli/raw/rawtrans.c
index 118ac5e3fd..b523232bc0 100644
--- a/source4/libcli/raw/rawtrans.c
+++ b/source4/libcli/raw/rawtrans.c
@@ -216,6 +216,14 @@ struct smbcli_request *smb_raw_trans_send_backend(struct smbcli_tree *tree,
size_t namelen = 0;
uint16_t data_disp, data_length, max_data;
+ if (parms->in.params.length > UINT16_MAX ||
+ parms->in.data.length > UINT16_MAX) {
+ DEBUG(3,("Attempt to send invalid trans2 request (params %u, data %u)\n",
+ parms->in.params.length, parms->in.data.length));
+ return NULL;
+ }
+
+
if (command == SMBtrans)
padding = 1;
else