From 1dd2351840c41232d8aea912be6304b256ea0329 Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Fri, 28 Feb 2014 15:50:21 +0000 Subject: [PATCH] torture: Fix a buffer overrun In test_EnumPrinterDrivers we go up to driver level 8. In C, this means we are accessing the 9th entry in the following lines: ctx->driver_count[level] = count; ctx->drivers[level] = info; Signed-off-by: Volker Lendecke Reviewed-by: David Disseldorp --- source4/torture/rpc/spoolss.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/source4/torture/rpc/spoolss.c b/source4/torture/rpc/spoolss.c index 135eb3cb760..b61efa43ddc 100644 --- a/source4/torture/rpc/spoolss.c +++ b/source4/torture/rpc/spoolss.c @@ -77,8 +77,8 @@ struct test_spoolss_context { union spoolss_PortInfo *ports[3]; /* for EnumPrinterDrivers */ - uint32_t driver_count[8]; - union spoolss_DriverInfo *drivers[8]; + uint32_t driver_count[9]; + union spoolss_DriverInfo *drivers[9]; /* for EnumMonitors */ uint32_t monitor_count[3];