sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-30 13:18:05 +03:00
Code

r3652: Fix malloc-history dependent failures in smbtorture.

Browse Source 
Because -r 3591 removed the over-allocation, realloc() had a chance of
returning a different pointer.  This broke the length calculations in
the trans2 send code.

I think the length calculations coudld be better expressed (less cute
PTR_DIFF tricks) but I'm not going to touch this any more than I need
to.

Andrew Bartlett
This commit is contained in:
Andrew Bartlett 2004-11-10 04:52:22 +00:00 committed by Gerald (Jerry) Carter
parent bd9497b092
commit 4bfc916a2c
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
source/libcli/raw/rawtrans.c
View File

@ -223,6 +223,12 @@ struct smbcli_request *smb_raw_trans_send_backend(struct smbcli_tree *tree,
return NULL; return NULL;
} }
/* Watch out, this changes the req->out.* pointers */
if (command == SMBtrans && parms->in.trans_name) {
namelen = smbcli_req_append_string(req, parms->in.trans_name,
STR_TERMINATE);
}
/* fill in SMB parameters */ /* fill in SMB parameters */
outparam = req->out.data + padding; outparam = req->out.data + padding;
outdata = outparam + parms->in.params.length; outdata = outparam + parms->in.params.length;
@ -230,11 +236,6 @@ struct smbcli_request *smb_raw_trans_send_backend(struct smbcli_tree *tree,
/* make sure we don't leak data via the padding */ /* make sure we don't leak data via the padding */
memset(req->out.data, 0, padding); memset(req->out.data, 0, padding);
if (command == SMBtrans && parms->in.trans_name) {
namelen = smbcli_req_append_string(req, parms->in.trans_name,
STR_TERMINATE);
}
/* primary request */ /* primary request */
SSVAL(req->out.vwv,VWV(0),parms->in.params.length); SSVAL(req->out.vwv,VWV(0),parms->in.params.length);
SSVAL(req->out.vwv,VWV(1),parms->in.data.length); SSVAL(req->out.vwv,VWV(1),parms->in.data.length);