sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-25 06:04:04 +03:00
Code

r9356: a better way of coping with NULL arrays in the array bounds checking. This copes with the

Browse Source 
case of size_is(*size) where size is NULL, and the array is NULL
(This used to be commit 56769b4b1d900cce60cd35298b642a85e4eddfee)
This commit is contained in:
Andrew Tridgell 2005-08-17 12:28:47 +00:00 committed by Gerald (Jerry) Carter
parent 4e3cacdaa8
commit 36fb8185ed
2 changed files with 4 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
source4/build/pidl/Parse/Pidl/Samba/NDR/Parser.pm
View File

@ -319,14 +319,18 @@ sub ParseArrayPullHeader($$$$$)
if ($l->{IS_CONFORMANT} and not $l->{IS_ZERO_TERMINATED}) {
my $size = ParseExpr($l->{SIZE_IS}, $env);
defer "if ($var_name) {";
check_null_pointer_deferred($size);
defer "NDR_CHECK(ndr_check_array_size(ndr, (void*)" . get_pointer_to($var_name) . ", $size));";
defer "}";
}
if ($l->{IS_VARYING} and not $l->{IS_ZERO_TERMINATED}) {
my $length = ParseExpr($l->{LENGTH_IS}, $env);
defer "if ($var_name) {";
check_null_pointer_deferred($length);
defer "NDR_CHECK(ndr_check_array_length(ndr, (void*)" . get_pointer_to($var_name) . ", $length));";
defer "}"
}
if (!$l->{IS_FIXED}) {

8
source4/librpc/ndr/ndr.c
View File

@ -493,10 +493,6 @@ uint32_t ndr_get_array_size(struct ndr_pull *ndr, const void *p)
NTSTATUS ndr_check_array_size(struct ndr_pull *ndr, void *p, uint32_t size)
{
uint32_t stored;
/* a NULL array is OK */
if (*(void **)p == NULL) {
return NT_STATUS_OK;
}
stored = ndr_token_peek(&ndr->array_size_list, p);
if (stored != size) {
return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE,
@ -535,10 +531,6 @@ uint32_t ndr_get_array_length(struct ndr_pull *ndr, const void *p)
NTSTATUS ndr_check_array_length(struct ndr_pull *ndr, void *p, uint32_t length)
{
uint32_t stored;
/* a NULL array is OK */
if (*(void **)p == NULL) {
return NT_STATUS_OK;
}
stored = ndr_token_peek(&ndr->array_length_list, p);
if (stored != length) {
return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE,