From cae4c742a896c6adb02b3e7a3c091d02aebb7339 Mon Sep 17 00:00:00 2001
From: Jeremy Allison <jra@samba.org>
Date: Mon, 19 Nov 2007 17:43:28 -0800
Subject: Always check return from push_ascii. Jeremy. (This used to be commit
 9c3d10521e691169cfbb8b728f123911c3c970ae)

---
 source3/libsmb/clirap.c | 7 ++++++-
 source3/smbd/lanman.c   | 6 ++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

(limited to 'source3')

diff --git a/source3/libsmb/clirap.c b/source3/libsmb/clirap.c
index 9d106d0394..848a8d5482 100644
--- a/source3/libsmb/clirap.c
+++ b/source3/libsmb/clirap.c
@@ -216,6 +216,7 @@ bool cli_NetServerEnum(struct cli_state *cli, char *workgroup, uint32 stype,
 	pstring param;
 	int uLevel = 1;
 	int count = -1;
+	size_t len;
 
 	errno = 0; /* reset */
 
@@ -235,7 +236,11 @@ bool cli_NetServerEnum(struct cli_state *cli, char *workgroup, uint32 stype,
 	SIVAL(p,0,stype);
 	p += 4;
 
-	p += push_ascii(p, workgroup, sizeof(pstring)-PTR_DIFF(p,param)-1, STR_TERMINATE|STR_UPPER);
+	len = push_ascii(p, workgroup, sizeof(pstring)-PTR_DIFF(p,param)-1, STR_TERMINATE|STR_UPPER);
+	if (len == (size_t)-1) {
+		return false;
+	}
+	p += len;
 	
 	if (cli_api(cli, 
                     param, PTR_DIFF(p,param), 8,        /* params, length, max */
diff --git a/source3/smbd/lanman.c b/source3/smbd/lanman.c
index 4bd59a7aa6..b2e435e97f 100644
--- a/source3/smbd/lanman.c
+++ b/source3/smbd/lanman.c
@@ -112,6 +112,9 @@ static int CopyExpanded(connection_struct *conn,
 		return 0;
 	}
 	l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
+	if (l == -1) {
+		return 0;
+	}
 	(*dst) += l;
 	(*p_space_remaining) -= l;
 	return l;
@@ -124,6 +127,9 @@ static int CopyAndAdvance(char **dst, char *src, int *n)
 		return 0;
 	}
 	l = push_ascii(*dst,src,*n, STR_TERMINATE);
+	if (l == -1) {
+		return 0;
+	}
 	(*dst) += l;
 	(*n) -= l;
 	return l;
-- 
cgit