diff options
| author | Andrew Tridgell <tridge@samba.org> | 2004-12-12 08:35:11 +0000 |
|---|---|---|
| committer | Gerald (Jerry) Carter <jerry@samba.org> | 2007-10-10 13:07:20 -0500 |
| commit | 1960714669d03ce6c2f1fda34e9798cda555c962 (patch) | |
| tree | 26649cdfa6ee3d0a2663facb634a1be0ed502465 /source4 | |
| parent | f2dbe4610704d97725a69c076af52fbb6e899640 (diff) | |
| download | samba-1960714669d03ce6c2f1fda34e9798cda555c962.tar.gz samba-1960714669d03ce6c2f1fda34e9798cda555c962.tar.bz2 samba-1960714669d03ce6c2f1fda34e9798cda555c962.zip | |
r4161: two more fixes for NT4 clients. Bugs found by kukks.
- nt4 doesn't setup the pfc flags correctly for rpc packet types
other than normal requests, so don't check for fragmented packets
unless they are of type request
- ensure we give STATUS_BUFFER_OVERFLOW when we return a partial
fragment in SMBtrans requests on ncacn_np
(This used to be commit 83ebffec3215c58c5cebf1a7c9a58904854203c8)
Diffstat (limited to 'source4')
| -rw-r--r-- | source4/rpc_server/dcerpc_server.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/source4/rpc_server/dcerpc_server.c b/source4/rpc_server/dcerpc_server.c index 3afe5f1dc5..6e608fd30b 100644 --- a/source4/rpc_server/dcerpc_server.c +++ b/source4/rpc_server/dcerpc_server.c @@ -849,7 +849,8 @@ NTSTATUS dcesrv_input_process(struct dcesrv_connection *dce_conn) dce_partial_advance(dce_conn, blob.length); /* see if this is a continued packet */ - if (!(call->pkt.pfc_flags & DCERPC_PFC_FLAG_FIRST)) { + if (call->pkt.ptype == DCERPC_PKT_REQUEST && + !(call->pkt.pfc_flags & DCERPC_PFC_FLAG_FIRST)) { struct dcesrv_call_state *call2 = call; uint32_t alloc_size; @@ -895,7 +896,8 @@ NTSTATUS dcesrv_input_process(struct dcesrv_connection *dce_conn) /* this may not be the last pdu in the chain - if its isn't then just put it on the call_list and wait for the rest */ - if (!(call->pkt.pfc_flags & DCERPC_PFC_FLAG_LAST)) { + if (call->pkt.ptype == DCERPC_PKT_REQUEST && + !(call->pkt.pfc_flags & DCERPC_PFC_FLAG_LAST)) { DLIST_ADD_END(dce_conn->call_list, call, struct dcesrv_call_state *); return NT_STATUS_OK; } @@ -998,6 +1000,8 @@ NTSTATUS dcesrv_output(struct dcesrv_connection *dce_conn, if (rep->data.length == 0) { /* we're done with this section of the call */ DLIST_REMOVE(call->replies, rep); + } else { + return STATUS_BUFFER_OVERFLOW; } if (call->replies == NULL) { |