The branch, master has been updated via 114f519233cd37bfd623db820e888469c75fab26 (commit) from 58db2befbd82b8e1e7cb7de29da7f567dea314e9 (commit)
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master - Log ----------------------------------------------------------------- commit 114f519233cd37bfd623db820e888469c75fab26 Author: Volker Lendecke <[EMAIL PROTECTED]> Date: Sat Nov 8 17:14:06 2008 +0100 Fix the offset checks in the trans routines This fixes a potential crash bug, a client can make us read memory we should not read. Luckily I got the disp checks right... Volker (cherry picked from commit 64a1d80851da5b05e70ec6c96f6e9bd473748369) (cherry picked from commit f04c5650a3aeca23591ddc781c4b297caaf9bb3f) ----------------------------------------------------------------------- Summary of changes: source3/smbd/ipc.c | 6 +++--- source3/smbd/nttrans.c | 6 +++--- source3/smbd/trans2.c | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) Changeset truncated at 500 lines: diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c index 26a4212..a617756 100644 --- a/source3/smbd/ipc.c +++ b/source3/smbd/ipc.c @@ -769,10 +769,10 @@ void reply_transs(struct smb_request *req) goto bad_param; } - if (ddisp > av_size || + if (doff > av_size || dcnt > av_size || - ddisp+dcnt > av_size || - ddisp+dcnt < ddisp) { + doff+dcnt > av_size || + doff+dcnt < doff) { goto bad_param; } diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c index 8a18c87..329ba23 100644 --- a/source3/smbd/nttrans.c +++ b/source3/smbd/nttrans.c @@ -2818,10 +2818,10 @@ void reply_nttranss(struct smb_request *req) goto bad_param; } - if (ddisp > av_size || + if (doff > av_size || dcnt > av_size || - ddisp+dcnt > av_size || - ddisp+dcnt < ddisp) { + doff+dcnt > av_size || + doff+dcnt < doff) { goto bad_param; } diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c index c385c6c..0c63588 100644 --- a/source3/smbd/trans2.c +++ b/source3/smbd/trans2.c @@ -7811,10 +7811,10 @@ void reply_transs2(struct smb_request *req) goto bad_param; } - if (ddisp > av_size || + if (doff > av_size || dcnt > av_size || - ddisp+dcnt > av_size || - ddisp+dcnt < ddisp) { + doff+dcnt > av_size || + doff+dcnt < doff) { goto bad_param; } -- Samba Shared Repository