diff options
| -rw-r--r-- | source4/smb_server/smb2/fileinfo.c | 5 | ||||
| -rw-r--r-- | source4/torture/smb2/getinfo.c | 35 |
2 files changed, 40 insertions, 0 deletions
diff --git a/source4/smb_server/smb2/fileinfo.c b/source4/smb_server/smb2/fileinfo.c index 942000133c..6c4b8f33d5 100644 --- a/source4/smb_server/smb2/fileinfo.c +++ b/source4/smb_server/smb2/fileinfo.c @@ -53,6 +53,11 @@ static void smb2srv_getinfo_send(struct ntvfs_request *ntvfs) SMB2SRV_CHECK(op->send_fn(op)); } + if (op->info->in.output_buffer_length < op->info->out.blob.length) { + smb2srv_send_error(req, NT_STATUS_INFO_LENGTH_MISMATCH); + return; + } + SMB2SRV_CHECK(smb2srv_setup_reply(req, 0x08, true, op->info->out.blob.length)); SMB2SRV_CHECK(smb2_push_o16s32_blob(&req->out, 0x02, op->info->out.blob)); diff --git a/source4/torture/smb2/getinfo.c b/source4/torture/smb2/getinfo.c index 906d6e4f8d..5b35d7e693 100644 --- a/source4/torture/smb2/getinfo.c +++ b/source4/torture/smb2/getinfo.c @@ -167,6 +167,40 @@ static bool torture_smb2_fsinfo(struct smb2_tree *tree) } +/* + test for buffer size handling +*/ +static bool torture_smb2_buffercheck(struct smb2_tree *tree) +{ + NTSTATUS status; + struct smb2_handle handle; + struct smb2_getinfo b; + + printf("Testing buffer size handling\n"); + status = smb2_util_roothandle(tree, &handle); + if (!NT_STATUS_IS_OK(status)) { + printf(__location__ " Unable to create root handle - %s\n", nt_errstr(status)); + return false; + } + + ZERO_STRUCT(b); + b.in.info_type = SMB2_GETINFO_FS; + b.in.info_class = 1; + b.in.output_buffer_length = 0x1; + b.in.input_buffer_length = 0; + b.in.file.handle = handle; + + status = smb2_getinfo(tree, tree, &b); + if (!NT_STATUS_EQUAL(status, NT_STATUS_INFO_LENGTH_MISMATCH)) { + printf(__location__ " Wrong error code for small buffer %s\n", + nt_errstr(status)); + return false; + } + + return true; +} + + /* basic testing of all SMB2 getinfo levels */ bool torture_smb2_getinfo(struct torture_context *torture) @@ -196,6 +230,7 @@ bool torture_smb2_getinfo(struct torture_context *torture) ret &= torture_smb2_fileinfo(torture, tree); ret &= torture_smb2_fsinfo(tree); + ret &= torture_smb2_buffercheck(tree); talloc_free(mem_ctx); |