sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-28 07:21:54 +03:00
Code

r3666: Generalise fix for trans and nttrans multi-fragment requests.

Browse Source 
Jeremy
This commit is contained in:
Jeremy Allison 2004-11-10 20:37:14 +00:00 committed by Gerald (Jerry) Carter
parent 44132c39ec
commit 10b2489e3b
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
source/smbd/ipc.c
View File

@ -502,7 +502,7 @@ int reply_trans(connection_struct *conn, char *inbuf,char *outbuf, int size, int
goto bad_param;
if (pcnt) {
if (pdisp+pcnt >= tpscnt)
if (pdisp+pcnt > tpscnt)
goto bad_param;
if ((pdisp+pcnt < pdisp) || (pdisp+pcnt < pcnt))
goto bad_param;
@ -518,7 +518,7 @@ int reply_trans(connection_struct *conn, char *inbuf,char *outbuf, int size, int
}
if (dcnt) {
if (ddisp+dcnt >= tdscnt)
if (ddisp+dcnt > tdscnt)
goto bad_param;
if ((ddisp+dcnt < ddisp) || (ddisp+dcnt < dcnt))
goto bad_param;

4
source/smbd/nttrans.c
View File

@ -2825,7 +2825,7 @@ due to being in oplock break state.\n", (unsigned int)function_code ));
}
if (parameter_count) {
if (parameter_displacement + parameter_count >= total_parameter_count)
if (parameter_displacement + parameter_count > total_parameter_count)
goto bad_param;
if ((parameter_displacement + parameter_count < parameter_displacement) ||
(parameter_displacement + parameter_count < parameter_count))
@ -2842,7 +2842,7 @@ due to being in oplock break state.\n", (unsigned int)function_code ));
}
if (data_count) {
if (data_displacement + data_count >= total_data_count)
if (data_displacement + data_count > total_data_count)
goto bad_param;
if ((data_displacement + data_count < data_displacement) ||
(data_displacement + data_count < data_count))