diff options
| author | Volker Lendecke <vl@samba.org> | 2013-08-27 09:37:34 +0000 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2013-09-18 10:41:22 +0200 |
| commit | c9d16d1567a736c8a4323ab746ace86c5a68f51a (patch) | |
| tree | 6cc151558f30af0d3b072a89ae5383755dc34240 /source3 | |
| parent | 926383e5c4a4ca79561b0204d6bd7102146a83d3 (diff) | |
| download | samba-c9d16d1567a736c8a4323ab746ace86c5a68f51a.tar.gz | |
smbd: Correctly return BUFFER_OVERFLOW in smb2_getinfo
Also, don't overflow the client buffer
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10106
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 40f60024ca19e33cbbe9825b42692f386a8f1dd9)
(cherry picked from commit f5dfa2ac931d52b4517f4e5e07cf9730e6939967)
Diffstat (limited to 'source3')
| -rw-r--r-- | source3/smbd/smb2_getinfo.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/source3/smbd/smb2_getinfo.c b/source3/smbd/smb2_getinfo.c index 714a6bdf08b..6f901e3a36e 100644 --- a/source3/smbd/smb2_getinfo.c +++ b/source3/smbd/smb2_getinfo.c @@ -397,6 +397,11 @@ static struct tevent_req *smbd_smb2_getinfo_send(TALLOC_CTX *mem_ctx, if (tevent_req_nomem(state->out_output_buffer.data, req)) { return tevent_req_post(req, ev); } + if (data_size > in_output_buffer_length) { + state->out_output_buffer.length = + in_output_buffer_length; + status = STATUS_BUFFER_OVERFLOW; + } } SAFE_FREE(data); break; @@ -445,6 +450,11 @@ static struct tevent_req *smbd_smb2_getinfo_send(TALLOC_CTX *mem_ctx, if (tevent_req_nomem(state->out_output_buffer.data, req)) { return tevent_req_post(req, ev); } + if (data_size > in_output_buffer_length) { + state->out_output_buffer.length = + in_output_buffer_length; + status = STATUS_BUFFER_OVERFLOW; + } } SAFE_FREE(data); break; |