summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--source3/smbd/reply.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index ec63be32b4..011186ba89 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -2784,7 +2784,11 @@ int reply_echo(connection_struct *conn,
int outsize = set_message(outbuf,1,data_len,True);
START_PROFILE(SMBecho);
- data_len = MIN(data_len, (sizeof(inbuf)-(smb_buf(inbuf)-inbuf)));
+ if (data_len > BUFFER_SIZE) {
+ DEBUG(0,("reply_echo: data_len too large.\n"));
+ END_PROFILE(SMBecho);
+ return -1;
+ }
/* copy any incoming data back out */
if (data_len > 0)