sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Code

libcli/smb: check the buffer length in smbXcli_negprot_dispatch_incoming()

Browse Source 
metze
This commit is contained in:
Stefan Metzmacher 2012-07-20 09:20:43 +02:00
parent 1c144b07f6
commit 077eb578be
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libcli/smb/smbXcli_base.c
View File

@ -3952,16 +3952,23 @@ static NTSTATUS smbXcli_negprot_dispatch_incoming(struct smbXcli_conn *conn,
struct tevent_req *subreq;
struct smbXcli_req_state *substate;
struct tevent_req *req;
uint32_t protocol_magic = IVAL(inbuf, 4);
uint32_t protocol_magic;
size_t inbuf_len = smb_len_nbt(inbuf);
if (num_pending != 1) {
return NT_STATUS_INTERNAL_ERROR;
}
if (inbuf_len < 4) {
return NT_STATUS_INVALID_NETWORK_RESPONSE;
}
subreq = conn->pending[0];
substate = tevent_req_data(subreq, struct smbXcli_req_state);
req = tevent_req_callback_data(subreq, struct tevent_req);
protocol_magic = IVAL(inbuf, 4);
switch (protocol_magic) {
case SMB_MAGIC:
tevent_req_set_callback(subreq, smbXcli_negprot_smb1_done, req);