sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
Code

smb2_ioctl: copychunk request max output validation

Browse Source 
Check that the copychunk ioctl request maximum output specified by the
client is large enough to hold copychunk response data.

Reviewed by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jan 17 00:59:44 CET 2013 on sn-devel-104
This commit is contained in:
David Disseldorp 2013-01-15 17:23:12 +01:00 committed by Jeremy Allison
parent bf07c33dac
commit 8e63a72ec1
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
source3/smbd/smb2_ioctl_network_fs.c
View File

@ -175,6 +175,7 @@ static struct tevent_req *fsctl_srv_copychunk_send(TALLOC_CTX *mem_ctx,
struct tevent_context *ev,
struct files_struct *dst_fsp,
DATA_BLOB *in_input,
size_t in_max_output,
struct smbd_smb2_request *smb2req)
{
struct tevent_req *req;
@ -192,6 +193,16 @@ static struct tevent_req *fsctl_srv_copychunk_send(TALLOC_CTX *mem_ctx,
return NULL;
}
state->conn = dst_fsp->conn;
if (in_max_output < sizeof(struct srv_copychunk_rsp)) {
DEBUG(3, ("max output %d not large enough to hold copy chunk "
"response %lu\n", (int)in_max_output,
sizeof(struct srv_copychunk_rsp)));
state->status = NT_STATUS_INVALID_PARAMETER;
tevent_req_nterror(req, state->status);
return tevent_req_post(req, ev);
}
ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &cc_copy,
(ndr_pull_flags_fn_t)ndr_pull_srv_copychunk_copy);
if (ndr_ret != NDR_ERR_SUCCESS) {
@ -515,6 +526,7 @@ struct tevent_req *smb2_ioctl_network_fs(uint32_t ctl_code,
case FSCTL_SRV_COPYCHUNK:
subreq = fsctl_srv_copychunk_send(state, ev, state->fsp,
&state->in_input,
state->in_max_output,
state->smb2req);
if (tevent_req_nomem(subreq, req)) {
return tevent_req_post(req, ev);