The branch, v3-3-test has been updated via 7e07ec68f15908a998f83d615a1b4d1349935a54 (commit) from 6c1904f8be1b4e08b09b64052c1aba24e7a4fb3d (commit)
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-3-test - Log ----------------------------------------------------------------- commit 7e07ec68f15908a998f83d615a1b4d1349935a54 Author: Volker Lendecke <[EMAIL PROTECTED]> Date: Fri Jun 13 15:30:08 2008 +0200 Fix a crash in _winreg_QueryValue Coverity ID 474, value_length and type are both unique, not ref pointers and can thus be NULL. Karolin, please merge this to -stable. Thanks, Volker (cherry picked from commit 999533c0ccced59141d8baff5bc248d63e2a966f) ----------------------------------------------------------------------- Summary of changes: source/rpc_server/srv_winreg_nt.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) Changeset truncated at 500 lines: diff --git a/source/rpc_server/srv_winreg_nt.c b/source/rpc_server/srv_winreg_nt.c index 7b74871..84bcf0b 100644 --- a/source/rpc_server/srv_winreg_nt.c +++ b/source/rpc_server/srv_winreg_nt.c @@ -230,6 +230,10 @@ WERROR _winreg_QueryValue(pipes_struct *p, struct winreg_QueryValue *r) if ( !regkey ) return WERR_BADFID; + if ((r->out.value_length == NULL) || (r->out.type == NULL)) { + return WERR_INVALID_PARAM; + } + *r->out.value_length = *r->out.type = REG_NONE; DEBUG(7,("_reg_info: policy key name = [%s]\n", regkey->key->name)); -- Samba Shared Repository