diff options
| author | Volker Lendecke <vl@samba.org> | 2008-06-13 15:30:08 +0200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2008-06-13 15:50:53 +0200 |
| commit | 9b52e702d96a552f68e1af451ccdaf052b8c49a1 (patch) | |
| tree | 281e64fbd51fa0e54e5a0db3427fa5be0c57e8e3 | |
| parent | f2042c94b8ab7fbbdaf7f7ca954a0b3e1b11b964 (diff) | |
| download | samba-9b52e702d96a552f68e1af451ccdaf052b8c49a1.tar.gz | |
Fix a crash in _winreg_QueryValue
Coverity ID 474, value_length and type are both unique, not ref pointers and
can thus be NULL.
Karolin, please merge this to -stable.
Thanks,
Volker
(cherry picked from commit 999533c0ccced59141d8baff5bc248d63e2a966f)
| -rw-r--r-- | source/rpc_server/srv_winreg_nt.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/source/rpc_server/srv_winreg_nt.c b/source/rpc_server/srv_winreg_nt.c index 7b748711048..84bcf0bf892 100644 --- a/source/rpc_server/srv_winreg_nt.c +++ b/source/rpc_server/srv_winreg_nt.c @@ -230,6 +230,10 @@ WERROR _winreg_QueryValue(pipes_struct *p, struct winreg_QueryValue *r) if ( !regkey ) return WERR_BADFID; + if ((r->out.value_length == NULL) || (r->out.type == NULL)) { + return WERR_INVALID_PARAM; + } + *r->out.value_length = *r->out.type = REG_NONE; DEBUG(7,("_reg_info: policy key name = [%s]\n", regkey->key->name)); |