sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-19 18:50:24 +03:00
Code

libcli/smb: fix BUFFER_OVERFLOW handling in tstream_smbXcli_np

Browse Source 
The special error is not NT_STATUS_BUFFER_TOO_SMALL, but STATUS_BUFFER_OVERFLOW.

Tested using TSTREAM_SMBXCLI_NP_MAX_BUF_SIZE == 20 and running
the following commands against a Windows 2012R2 server:

bin/smbtorture ncacn_np:SERVER[] rpc.lsa-getuser
bin/smbtorture ncacn_np:SERVER[smb2] rpc.lsa-getuser

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11623

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Dec  1 03:42:52 CET 2015 on sn-devel-104

(cherry picked from commit 3bbd8d3614af641535ab0925303ad07c03c4e094)
This commit is contained in:
Stefan Metzmacher 2015-11-27 18:19:38 +01:00 committed by Karolin Seeger
parent 9cf45fee5c
commit ec56ef8aef
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
libcli/smb/tstream_smbXcli_np.c
View File

@ -980,7 +980,14 @@ static void tstream_smbXcli_np_readv_trans_done(struct tevent_req *subreq)
received = out_output_buffer.length;
}
TALLOC_FREE(subreq);
if (NT_STATUS_EQUAL(status, NT_STATUS_BUFFER_TOO_SMALL)) {
if (NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
/*
* STATUS_BUFFER_OVERFLOW means that there's
* more data to read when the named pipe is used
* in message mode (which is the case here).
*
* But we hide this from the caller.
*/
status = NT_STATUS_OK;
}
if (!NT_STATUS_IS_OK(status)) {
@ -1056,9 +1063,9 @@ static void tstream_smbXcli_np_readv_read_done(struct tevent_req *subreq)
* We can't TALLOC_FREE(subreq) as usual here, as rcvbuf still is a
* child of that.
*/
if (NT_STATUS_EQUAL(status, NT_STATUS_BUFFER_TOO_SMALL)) {
if (NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
/*
* NT_STATUS_BUFFER_TOO_SMALL means that there's
* STATUS_BUFFER_OVERFLOW means that there's
* more data to read when the named pipe is used
* in message mode (which is the case here).
*