sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-20 22:50:26 +03:00
Code

vfs_fruit: fix offset and len handling for AFP_AfpInfo stream

Browse Source 
When reading from the AFP_AfpInfo stream, OS X ignores the offset from
the request and always reads from offset=0.

The offset bounds check has a off-by-1 bug in OS X, so a request
offset=60 (AFP_AfpInfo stream has a ficed size of 60 bytes), len=1
returns 1 byte from offset 0 insteaf of returning 0.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11347

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit f569fd5e44300ab41aa7298b3efdcac99cd330f2)
This commit is contained in:
Ralph Boehme 2015-12-19 11:06:19 +01:00 committed by Karolin Seeger
parent f8bc71f657
commit de829e6068
1 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
source3/modules/vfs_fruit.c
View File

@ -2668,13 +2668,19 @@ static ssize_t fruit_pread(vfs_handle_struct *handle,
char afpinfo_buf[AFP_INFO_SIZE];
size_t to_return;
if ((offset < 0) || (offset >= AFP_INFO_SIZE)) {
/*
* OS X has a off-by-1 error in the offset calculation, so we're
* bug compatible here. It won't hurt, as any relevant real
* world read requests from the AFP_AfpInfo stream will be
* offset=0 n=60. offset is ignored anyway, see below.
*/
if ((offset < 0) || (offset >= AFP_INFO_SIZE + 1)) {
len = 0;
rc = 0;
goto exit;
}
to_return = AFP_INFO_SIZE - offset;
to_return = MIN(n, AFP_INFO_SIZE);
ai = afpinfo_new(talloc_tos());
if (ai == NULL) {
@ -2697,7 +2703,10 @@ static ssize_t fruit_pread(vfs_handle_struct *handle,
goto exit;
}
memcpy(data, afpinfo_buf + offset, to_return);
/*
* OS X ignores offset when reading from AFP_AfpInfo stream!
*/
memcpy(data, afpinfo_buf, to_return);
len = to_return;
} else {
len = SMB_VFS_NEXT_PREAD(