diff options
| -rw-r--r-- | source3/rpc_server/srv_pipe_hnd.c | 4 | ||||
| -rw-r--r-- | source3/smbd/pipes.c | 8 | ||||
| -rw-r--r-- | source3/smbd/trans2.c | 2 |
3 files changed, 6 insertions, 8 deletions
diff --git a/source3/rpc_server/srv_pipe_hnd.c b/source3/rpc_server/srv_pipe_hnd.c index 52518fc714..5dd28af8ab 100644 --- a/source3/rpc_server/srv_pipe_hnd.c +++ b/source3/rpc_server/srv_pipe_hnd.c @@ -1246,10 +1246,8 @@ static BOOL close_internal_rpc_pipe_hnd(void *np_conn) Find an rpc pipe given a pipe handle in a buffer and an offset. ****************************************************************************/ -smb_np_struct *get_rpc_pipe_p(const char *buf, int where) +smb_np_struct *get_rpc_pipe_p(uint16 pnum) { - int pnum = SVAL(buf,where); - if (chain_p) { return chain_p; } diff --git a/source3/smbd/pipes.c b/source3/smbd/pipes.c index a4ac807377..24e0f47001 100644 --- a/source3/smbd/pipes.c +++ b/source3/smbd/pipes.c @@ -140,7 +140,7 @@ void reply_open_pipe_and_X(connection_struct *conn, struct smb_request *req) int reply_pipe_write(char *inbuf,char *outbuf,int length,int dum_bufsize) { - smb_np_struct *p = get_rpc_pipe_p(inbuf,smb_vwv0); + smb_np_struct *p = get_rpc_pipe_p(SVAL(inbuf,smb_vwv0)); uint16 vuid = SVAL(inbuf,smb_uid); size_t numtowrite = SVAL(inbuf,smb_vwv1); int nwritten; @@ -185,7 +185,7 @@ int reply_pipe_write(char *inbuf,char *outbuf,int length,int dum_bufsize) int reply_pipe_write_and_X(char *inbuf,char *outbuf,int length,int bufsize) { - smb_np_struct *p = get_rpc_pipe_p(inbuf,smb_vwv2); + smb_np_struct *p = get_rpc_pipe_p(SVAL(inbuf,smb_vwv2)); uint16 vuid = SVAL(inbuf,smb_uid); size_t numtowrite = SVAL(inbuf,smb_vwv10); int nwritten = -1; @@ -247,7 +247,7 @@ int reply_pipe_write_and_X(char *inbuf,char *outbuf,int length,int bufsize) int reply_pipe_read_and_X(char *inbuf,char *outbuf,int length,int bufsize) { - smb_np_struct *p = get_rpc_pipe_p(inbuf,smb_vwv2); + smb_np_struct *p = get_rpc_pipe_p(SVAL(inbuf,smb_vwv2)); int smb_maxcnt = SVAL(inbuf,smb_vwv5); int smb_mincnt = SVAL(inbuf,smb_vwv6); int nread = -1; @@ -292,7 +292,7 @@ int reply_pipe_read_and_X(char *inbuf,char *outbuf,int length,int bufsize) void reply_pipe_close(connection_struct *conn, struct smb_request *req) { - smb_np_struct *p = get_rpc_pipe_p((char *)req->inbuf,smb_vwv0); + smb_np_struct *p = get_rpc_pipe_p(SVAL(req->inbuf,smb_vwv0)); if (!p) { reply_doserror(req, ERRDOS, ERRbadfid); diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c index d455a12fa1..77a13ad186 100644 --- a/source3/smbd/trans2.c +++ b/source3/smbd/trans2.c @@ -3244,7 +3244,7 @@ static int call_trans2qpipeinfo(connection_struct *conn, char *inbuf, char *outb return ERROR_NT(NT_STATUS_INVALID_PARAMETER); } - p_pipe = get_rpc_pipe_p(params,0); + p_pipe = get_rpc_pipe_p(SVAL(params,0)); if (p_pipe == NULL) { return ERROR_NT(NT_STATUS_INVALID_HANDLE); } |