sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-02 09:47:23 +03:00
Code

Arg. The fix for CVE-2007-6015 hadn't been merged into 3.2.

Browse Source 
Do so now....
Jeremy.
(This used to be commit 6b1246c29a0241c8e4bb98d659d847d010826b36)
This commit is contained in:
Jeremy Allison 2007-12-13 16:44:24 -08:00
parent 733425f312
commit 9e733924d9
2 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
source3/libsmb/clidgram.c
View File

@ -75,6 +75,12 @@ bool cli_send_mailslot(struct messaging_context *msg_ctx,
/* Setup the smb part. */
ptr -= 4; /* XXX Ugliness because of handling of tcp SMB length. */
memcpy(tmp,ptr,4);
if (smb_size + 17*2 + strlen(mailslot) + 1 + len > MAX_DGRAM_SIZE) {
DEBUG(0, ("cli_send_mailslot: Cannot write beyond end of packet\n"));
return False;
}
set_message(ptr,17,strlen(mailslot) + 1 + len,True);
memcpy(ptr,tmp,4);

6
source3/nmbd/nmbd_packets.c
View File

@ -1918,6 +1918,12 @@ bool send_mailslot(bool unique, const char *mailslot,char *buf, size_t len,
/* Setup the smb part. */
ptr -= 4; /* XXX Ugliness because of handling of tcp SMB length. */
memcpy(tmp,ptr,4);
if (smb_size + 17*2 + strlen(mailslot) + 1 + len > MAX_DGRAM_SIZE) {
DEBUG(0, ("send_mailslot: Cannot write beyond end of packet\n"));
return false;
}
set_message(ptr,17,strlen(mailslot) + 1 + len,True);
memcpy(ptr,tmp,4);