From dd0b2572eb4999572aec32bbd9764cc4bf3aeaf7 Mon Sep 17 00:00:00 2001 From: Andrew Tridgell Date: Tue, 13 Mar 2007 04:18:07 +0000 Subject: r21812: fixed an integer overflow error in the ndr push code. This needs to be fixed in Samba3 as well. It might be exploitable (I haven't confirmed one way or the other), so I think this should be fixed for 3.0.25 (This used to be commit 4766175ff2d0de8af92046e29280c7893ac8fe1f) --- source4/librpc/ndr/libndr.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'source4/librpc/ndr/libndr.h') diff --git a/source4/librpc/ndr/libndr.h b/source4/librpc/ndr/libndr.h index eb0c970208..e6bf7c04e2 100644 --- a/source4/librpc/ndr/libndr.h +++ b/source4/librpc/ndr/libndr.h @@ -219,7 +219,7 @@ enum ndr_compression_alg { } \ } while(0) -#define NDR_PUSH_NEED_BYTES(ndr, n) NDR_CHECK(ndr_push_expand(ndr, ndr->offset+(n))) +#define NDR_PUSH_NEED_BYTES(ndr, n) NDR_CHECK(ndr_push_expand(ndr, n)) #define NDR_PUSH_ALIGN(ndr, n) do { \ if (!(ndr->flags & LIBNDR_FLAG_NOALIGN)) { \ -- cgit