diff options
| -rw-r--r-- | source3/nmbd/nmbd_become_lmb.c | 6 | ||||
| -rw-r--r-- | source3/nmbd/nmbd_browsesync.c | 4 | ||||
| -rw-r--r-- | source3/nmbd/nmbd_packets.c | 15 |
3 files changed, 15 insertions, 10 deletions
diff --git a/source3/nmbd/nmbd_become_lmb.c b/source3/nmbd/nmbd_become_lmb.c index bac5589566..6f8e7efb1a 100644 --- a/source3/nmbd/nmbd_become_lmb.c +++ b/source3/nmbd/nmbd_become_lmb.c @@ -207,7 +207,7 @@ static void release_1d_name( struct subnet_record *subrec, char *workgroup_name, if((namerec = find_name_on_subnet( subrec, &nmbname, FIND_SELF_NAME))!=NULL) { struct userdata_struct *userdata; - int size = sizeof(struct userdata_struct) + sizeof(BOOL); + size_t size = sizeof(struct userdata_struct) + sizeof(BOOL); if((userdata = (struct userdata_struct *)malloc(size)) == NULL) { @@ -518,7 +518,7 @@ workgroup %s on subnet %s. Couldn't register name %s.\n", void become_local_master_browser(struct subnet_record *subrec, struct work_record *work) { struct userdata_struct *userdata; - int size = sizeof(struct userdata_struct) + sizeof(fstring) + 1; + size_t size = sizeof(struct userdata_struct) + sizeof(fstring) + 1; /* Sanity check. */ if (!lp_local_master()) @@ -563,7 +563,7 @@ in workgroup %s on subnet %s\n", userdata->copy_fn = NULL; userdata->free_fn = NULL; userdata->userdata_len = strlen(work->work_group)+1; - fstrcpy(userdata->data, work->work_group); + overmalloc_safe_strcpy(userdata->data, work->work_group, size - sizeof(*userdata) - 1); /* Register the special browser group name. */ register_name(subrec, MSBROWSE, 0x01, samba_nb_type|NB_GROUP, diff --git a/source3/nmbd/nmbd_browsesync.c b/source3/nmbd/nmbd_browsesync.c index c363ed0d34..b9082ee1c3 100644 --- a/source3/nmbd/nmbd_browsesync.c +++ b/source3/nmbd/nmbd_browsesync.c @@ -288,7 +288,7 @@ static void find_domain_master_name_query_success(struct subnet_record *subrec, struct work_record *work; struct nmb_name nmbname; struct userdata_struct *userdata; - int size = sizeof(struct userdata_struct) + sizeof(fstring)+1; + size_t size = sizeof(struct userdata_struct) + sizeof(fstring)+1; if( !(work = find_workgroup_on_subnet(subrec, q_name->name)) ) { @@ -333,7 +333,7 @@ static void find_domain_master_name_query_success(struct subnet_record *subrec, userdata->copy_fn = NULL; userdata->free_fn = NULL; userdata->userdata_len = strlen(work->work_group)+1; - fstrcpy(userdata->data, work->work_group); + overmalloc_safe_strcpy(userdata->data, work->work_group, size - sizeof(*userdata) - 1); node_status( subrec, &nmbname, answer_ip, domain_master_node_status_success, diff --git a/source3/nmbd/nmbd_packets.c b/source3/nmbd/nmbd_packets.c index d83cd10d0c..6c3446d6c8 100644 --- a/source3/nmbd/nmbd_packets.c +++ b/source3/nmbd/nmbd_packets.c @@ -1929,7 +1929,7 @@ BOOL listen_for_packets(BOOL run_election) /**************************************************************************** Construct and send a netbios DGRAM. **************************************************************************/ -BOOL send_mailslot(BOOL unique, const char *mailslot,char *buf,int len, +BOOL send_mailslot(BOOL unique, const char *mailslot,char *buf, size_t len, const char *srcname, int src_type, const char *dstname, int dest_type, struct in_addr dest_ip,struct in_addr src_ip, @@ -1979,11 +1979,16 @@ BOOL send_mailslot(BOOL unique, const char *mailslot,char *buf,int len, SSVAL(ptr,smb_vwv15,1); SSVAL(ptr,smb_vwv16,2); p2 = smb_buf(ptr); - pstrcpy(p2,mailslot); + safe_strcpy_base(p2, mailslot, dgram->data, sizeof(dgram->data)); p2 = skip_string(p2,1); - - memcpy(p2,buf,len); - p2 += len; + + if (((p2+len) > dgram->data+sizeof(dgram->data)) || ((p2+len) < p2)) { + DEBUG(0, ("send_mailslot: Cannot write beyond end of packet\n")); + return False; + } else { + memcpy(p2,buf,len); + p2 += len; + } dgram->datasize = PTR_DIFF(p2,ptr+4); /* +4 for tcp length. */ |