sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-13 13:18:06 +03:00
Code

s3: smbd: SMB1 add range checks to reply_search().

Browse Source 
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
This commit is contained in:
Jeremy Allison 2019-07-03 12:13:59 -07:00 committed by Ralph Boehme
parent 173923c41a
commit 522fe23612
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
source3/smbd/reply.c
View File

@ -1801,6 +1801,11 @@ void reply_search(struct smb_request *req)
goto out;
}
if (smbreq_bufrem(req, p) < 3) {
reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
goto out;
}
p++;
status_len = SVAL(p, 0);
p += 2;
@ -1880,6 +1885,11 @@ void reply_search(struct smb_request *req)
int status_dirtype;
const char *dirpath;
if (smbreq_bufrem(req, p) < 21) {
reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
goto out;
}
memcpy(status,p,21);
status_dirtype = CVAL(status,0) & 0x1F;
if (status_dirtype != (dirtype & 0x1F)) {