sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-27 03:21:53 +03:00
Code

fix smb_len calculation for chained requests

Browse Source 
I think chain_reply() is one of the most tricky parts of Samba. This recursion
needs to go away, we need to sequentially walk the chain list.
This commit is contained in:
Volker Lendecke 2008-08-10 17:53:35 +02:00
parent 0ff16e8573
commit af2b01d851
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
source/smbd/process.c
View File

@ -1653,6 +1653,7 @@ void chain_reply(struct smb_request *req)
char *outbuf = (char *)req->outbuf;
size_t outsize = smb_len(outbuf) + 4;
size_t outsize_padded;
size_t padding;
size_t ofs, to_move;
struct smb_request *req2;
@ -1691,6 +1692,7 @@ void chain_reply(struct smb_request *req)
*/
outsize_padded = (outsize + 3) & ~3;
padding = outsize_padded - outsize;
/*
* remember how much the caller added to the chain, only counting
@ -1804,17 +1806,17 @@ void chain_reply(struct smb_request *req)
SCVAL(outbuf, smb_vwv0, smb_com2);
SSVAL(outbuf, smb_vwv1, chain_size + smb_wct - 4);
if (outsize_padded > outsize) {
if (padding != 0) {
/*
* Due to padding we have some uninitialized bytes after the
* caller's output
*/
memset(outbuf + outsize, 0, outsize_padded - outsize);
memset(outbuf + outsize, 0, padding);
}
smb_setlen(outbuf, outsize2 + chain_size - 4);
smb_setlen(outbuf, outsize2 + caller_outputlen + padding - 4);
/*
* restore the saved data, being careful not to overwrite any data