diff options
| author | Volker Lendecke <vl@samba.org> | 2015-02-17 20:18:37 +0000 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2015-02-24 17:52:09 +0100 |
| commit | c7fe434d48fb52a7db18405004da03e479aec8d4 (patch) | |
| tree | c057870b845293f04a90a257c0ab77f9a778840b /libcli | |
| parent | 7bcd7e2f5ca4dd88871588239ee7d2285d6e0d83 (diff) | |
| download | samba-c7fe434d48fb52a7db18405004da03e479aec8d4.tar.gz samba-c7fe434d48fb52a7db18405004da03e479aec8d4.tar.xz samba-c7fe434d48fb52a7db18405004da03e479aec8d4.zip | |
lib: Use iov_buflen in smb1cli_req_create
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Diffstat (limited to 'libcli')
| -rw-r--r-- | libcli/smb/smbXcli_base.c | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c index b9c3c8b836..ba00e96219 100644 --- a/libcli/smb/smbXcli_base.c +++ b/libcli/smb/smbXcli_base.c @@ -1266,6 +1266,7 @@ struct tevent_req *smb1cli_req_create(TALLOC_CTX *mem_ctx, uint16_t flags2 = 0; uint16_t uid = 0; uint16_t tid = 0; + ssize_t num_bytes; if (iov_count > MAX_SMB_IOV) { /* @@ -1337,7 +1338,17 @@ struct tevent_req *smb1cli_req_create(TALLOC_CTX *mem_ctx, state->smb1.vwv = vwv; - SSVAL(state->smb1.bytecount_buf, 0, smbXcli_iov_len(bytes_iov, iov_count)); + num_bytes = iov_buflen(bytes_iov, iov_count); + if (num_bytes == -1) { + /* + * I'd love to add a check for num_bytes<=UINT16_MAX here, but + * the smbclient->samba connections can lie and transfer more. + */ + TALLOC_FREE(req); + return NULL; + } + + SSVAL(state->smb1.bytecount_buf, 0, num_bytes); state->smb1.iov[0].iov_base = (void *)state->length_hdr; state->smb1.iov[0].iov_len = sizeof(state->length_hdr); |