sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-27 14:04:05 +03:00
Code

- don't generate 0 params in torture

Browse Source 
- handle 0 params in ipc.c
(This used to be commit c0dc8e87f0d56444a8ddff0817a94065ca295847)
This commit is contained in:
Andrew Tridgell 1998-10-08 06:49:00 +00:00
parent 788263ba2f
commit a813f38e2d
3 changed files with 20 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
source3/libsmb/clientgen.c
View File

@ -432,9 +432,9 @@ BOOL cli_NetWkstaUserLogon(struct cli_state *cli,char *user, char *workstation)
pstrcpy(p,user); pstrcpy(p,user);
strupper(p); strupper(p);
p += 21; p += 21;
p++; p++;
p += 15; p += 15;
p++; p++;
pstrcpy(p, workstation); pstrcpy(p, workstation);
strupper(p); strupper(p);
p += 16; p += 16;

26
source3/smbd/ipc.c
View File

@ -3348,7 +3348,7 @@ struct
static int api_reply(connection_struct *conn,uint16 vuid,char *outbuf,char *data,char *params, static int api_reply(connection_struct *conn,uint16 vuid,char *outbuf,char *data,char *params,
int tdscnt,int tpscnt,int mdrcnt,int mprcnt) int tdscnt,int tpscnt,int mdrcnt,int mprcnt)
{ {
int api_command = SVAL(params,0); int api_command;
struct mem_buf rdata_buf; struct mem_buf rdata_buf;
struct mem_buf rparam_buf; struct mem_buf rparam_buf;
char *rdata = NULL; char *rdata = NULL;
@ -3358,8 +3358,14 @@ static int api_reply(connection_struct *conn,uint16 vuid,char *outbuf,char *data
BOOL reply=False; BOOL reply=False;
int i; int i;
SMB_ASSERT(params != 0);
api_command = SVAL(params,0);
DEBUG(3,("Got API command %d of form <%s> <%s> (tdscnt=%d,tpscnt=%d,mdrcnt=%d,mprcnt=%d)\n", DEBUG(3,("Got API command %d of form <%s> <%s> (tdscnt=%d,tpscnt=%d,mdrcnt=%d,mprcnt=%d)\n",
api_command,params+2,skip_string(params+2,1), api_command,
params+2,
skip_string(params+2,1),
tdscnt,tpscnt,mdrcnt,mprcnt)); tdscnt,tpscnt,mdrcnt,mprcnt));
for (i=0;api_commands[i].name;i++) for (i=0;api_commands[i].name;i++)
@ -3448,7 +3454,6 @@ static int named_pipe(connection_struct *conn,uint16 vuid, char *outbuf,char *na
int reply_trans(connection_struct *conn, char *inbuf,char *outbuf, int size, int bufsize) int reply_trans(connection_struct *conn, char *inbuf,char *outbuf, int size, int bufsize)
{ {
fstring name; fstring name;
char *data=NULL,*params=NULL; char *data=NULL,*params=NULL;
uint16 *setup=NULL; uint16 *setup=NULL;
int outsize = 0; int outsize = 0;
@ -3475,17 +3480,17 @@ int reply_trans(connection_struct *conn, char *inbuf,char *outbuf, int size, int
if (tdscnt) { if (tdscnt) {
if((data = (char *)malloc(tdscnt)) == NULL) { if((data = (char *)malloc(tdscnt)) == NULL) {
DEBUG(0,("reply_trans: data malloc fail for %d bytes !\n", tdscnt)); DEBUG(0,("reply_trans: data malloc fail for %d bytes !\n", tdscnt));
return(ERROR(ERRDOS,ERRnomem)); return(ERROR(ERRDOS,ERRnomem));
} }
memcpy(data,smb_base(inbuf)+dsoff,dscnt); memcpy(data,smb_base(inbuf)+dsoff,dscnt);
} }
if (tpscnt) { if (tpscnt) {
if((params = (char *)malloc(tpscnt)) == NULL) { if((params = (char *)malloc(tpscnt)) == NULL) {
DEBUG(0,("reply_trans: param malloc fail for %d bytes !\n", tpscnt)); DEBUG(0,("reply_trans: param malloc fail for %d bytes !\n", tpscnt));
return(ERROR(ERRDOS,ERRnomem)); return(ERROR(ERRDOS,ERRnomem));
} }
memcpy(params,smb_base(inbuf)+psoff,pscnt); memcpy(params,smb_base(inbuf)+psoff,pscnt);
} }
@ -3560,7 +3565,8 @@ int reply_trans(connection_struct *conn, char *inbuf,char *outbuf, int size, int
if (strncmp(name,"\\PIPE\\",strlen("\\PIPE\\")) == 0) { if (strncmp(name,"\\PIPE\\",strlen("\\PIPE\\")) == 0) {
DEBUG(5,("calling named_pipe\n")); DEBUG(5,("calling named_pipe\n"));
outsize = named_pipe(conn,vuid,outbuf,name+strlen("\\PIPE\\"),setup,data,params, outsize = named_pipe(conn,vuid,outbuf,
name+strlen("\\PIPE\\"),setup,data,params,
suwcnt,tdscnt,tpscnt,msrcnt,mdrcnt,mprcnt); suwcnt,tdscnt,tpscnt,msrcnt,mdrcnt,mprcnt);
} else { } else {
DEBUG(3,("invalid pipe name\n")); DEBUG(3,("invalid pipe name\n"));

2
source3/utils/torture.c
View File

@ -623,7 +623,7 @@ static void run_randomipc(void)
for (i=0;i<1000;i++) { for (i=0;i<1000;i++) {
api = sys_random() % 500; api = sys_random() % 500;
param_len = sys_random() % 64; param_len = (sys_random() % 64) + 4;
rand_buf(param, param_len); rand_buf(param, param_len);