sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-28 01:58:17 +03:00
Code

smbd/smb2_ioctl: fail zero length copy chunk requests

Browse Source 
As documented in MS-SMB2 3.3.5.15.6 Handling a Server-Side Data Copy
Request, an invalid parameter response should be sent when:

The Length value in a single chunk is greater than
ServerSideCopyMaxChunkSize or *equal to zero*.

We do not currently abide by the latter part of this clause.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10424

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
This commit is contained in:
David Disseldorp 2014-02-06 20:12:21 +01:00 committed by Jeremy Allison
parent 54d07da81e
commit 00906f9604
1 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
source3/smbd/smb2_ioctl_network_fs.c
View File

@ -46,16 +46,31 @@ static NTSTATUS copychunk_check_limits(struct srv_copychunk_copy *cc_copy)
uint32_t i;
uint32_t total_len = 0;
/*
* [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
* Send and invalid parameter response if:
* - The ChunkCount value is greater than
* ServerSideCopyMaxNumberofChunks
*/
if (cc_copy->chunk_count > COPYCHUNK_MAX_CHUNKS) {
return NT_STATUS_INVALID_PARAMETER;
}
for (i = 0; i < cc_copy->chunk_count; i++) {
if (cc_copy->chunks[i].length > COPYCHUNK_MAX_CHUNK_LEN) {
/*
* - The Length value in a single chunk is greater than
* ServerSideCopyMaxChunkSize or equal to zero.
*/
if ((cc_copy->chunks[i].length == 0)
|| (cc_copy->chunks[i].length > COPYCHUNK_MAX_CHUNK_LEN)) {
return NT_STATUS_INVALID_PARAMETER;
}
total_len += cc_copy->chunks[i].length;
}
/*
* - Sum of Lengths in all chunks is greater than
* ServerSideCopyMaxDataSize
*/
if (total_len > COPYCHUNK_MAX_TOTAL_LEN) {
return NT_STATUS_INVALID_PARAMETER;
}