sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-10 12:58:35 +03:00
Code

r23752: Fix bug introduced by checkin 22920, allow large

Browse Source 
readX. Fix from Dmitry Shatrov <dhsatrov@linux.vnet.ibm.com>.

"In send_file_readX(), if startpos > sbuf.st_size, then smb_maxcnt is set
to an invalid large value due to integer overflow.
As for me, this resulted in MS Word hanging while trying to save
a 1.5Mb document."

This isn't in shipping code.

Jeremy.
(This used to be commit af715c602a8ef6038e6272c7cc6a08501617ae67)
This commit is contained in:
Jeremy Allison 2007-07-09 00:48:07 +00:00 committed by Gerald (Jerry) Carter
parent 052ddc9cd0
commit 59590a1c4d
1 changed files with 1 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
source3/smbd/reply.c
View File

@ -2590,9 +2590,7 @@ int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length
if (startpos > sbuf.st_size) {
smb_maxcnt = 0;
}
if (smb_maxcnt > (sbuf.st_size - startpos)) {
} else if (smb_maxcnt > (sbuf.st_size - startpos)) {
smb_maxcnt = (sbuf.st_size - startpos);
}