From 7c9e113f1de1561fb5caf4ae4afe52b5d853b655 Mon Sep 17 00:00:00 2001 From: Andrew Tridgell Date: Wed, 13 Oct 2004 13:00:57 +0000 Subject: r2949: added some range checks in samr.idl (This used to be commit 8921e34f989977efc5f9d4f5eabf21bbb5f52115) --- source4/librpc/idl/samr.idl | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/source4/librpc/idl/samr.idl b/source4/librpc/idl/samr.idl index 8fdc8a92fd..507d327417 100644 --- a/source4/librpc/idl/samr.idl +++ b/source4/librpc/idl/samr.idl @@ -48,7 +48,7 @@ /* Function: 0x02 */ typedef struct { - [value(ndr_size_security_descriptor(r->sd))] uint32 sd_size; + [range(0,262144),value(ndr_size_security_descriptor(r->sd))] uint32 sd_size; [subcontext(4)] security_descriptor *sd; } samr_SdBuf; @@ -328,7 +328,7 @@ } samr_SidType; typedef struct { - uint32 count; + [range(0,1024)] uint32 count; [size_is(count)] uint32 *ids; } samr_Ids; @@ -343,7 +343,7 @@ NTSTATUS samr_LookupNames( [in,ref] policy_handle *domain_handle, - [in] uint32 num_names, + [in,range(0,1000)] uint32 num_names, [in,ref,size_is(1000),length_is(num_names)] samr_Name *names, [out] samr_Ids rids, [out] samr_Ids types @@ -360,7 +360,7 @@ NTSTATUS samr_LookupRids( [in,ref] policy_handle *domain_handle, - [in] uint32 num_rids, + [in,range(0,1000)] uint32 num_rids, [in,ref,size_is(1000),length_is(num_rids)] uint32 *rids, [out] samr_Names names, [out] samr_Ids types -- cgit