diff options
| -rw-r--r-- | source3/smbd/ipc.c | 6 | ||||
| -rw-r--r-- | source3/smbd/nttrans.c | 6 | ||||
| -rw-r--r-- | source3/smbd/trans2.c | 6 |
3 files changed, 9 insertions, 9 deletions
diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c index 26a4212ec9..a617756a53 100644 --- a/source3/smbd/ipc.c +++ b/source3/smbd/ipc.c @@ -769,10 +769,10 @@ void reply_transs(struct smb_request *req) goto bad_param; } - if (ddisp > av_size || + if (doff > av_size || dcnt > av_size || - ddisp+dcnt > av_size || - ddisp+dcnt < ddisp) { + doff+dcnt > av_size || + doff+dcnt < doff) { goto bad_param; } diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c index 8a18c87903..329ba23ddd 100644 --- a/source3/smbd/nttrans.c +++ b/source3/smbd/nttrans.c @@ -2818,10 +2818,10 @@ void reply_nttranss(struct smb_request *req) goto bad_param; } - if (ddisp > av_size || + if (doff > av_size || dcnt > av_size || - ddisp+dcnt > av_size || - ddisp+dcnt < ddisp) { + doff+dcnt > av_size || + doff+dcnt < doff) { goto bad_param; } diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c index c385c6ccb1..0c63588ccc 100644 --- a/source3/smbd/trans2.c +++ b/source3/smbd/trans2.c @@ -7811,10 +7811,10 @@ void reply_transs2(struct smb_request *req) goto bad_param; } - if (ddisp > av_size || + if (doff > av_size || dcnt > av_size || - ddisp+dcnt > av_size || - ddisp+dcnt < ddisp) { + doff+dcnt > av_size || + doff+dcnt < doff) { goto bad_param; } |