diff options
| author | Matthias Dieter Wallnöfer <mwallnoefer@yahoo.de> | 2010-03-10 09:22:42 +0100 |
|---|---|---|
| committer | Matthias Dieter Wallnöfer <mwallnoefer@yahoo.de> | 2010-03-10 09:26:17 +0100 |
| commit | eeb05bf746b0eeeba94fe51180e0ebf855c6967a (patch) | |
| tree | 4a5aff143e78b22e8df657295e0b1438445a67b0 /source4/rpc_server/winreg | |
| parent | bb507d1d49917fcdeebb8fc3c40b6fabf4055b7d (diff) | |
| download | samba-eeb05bf746b0eeeba94fe51180e0ebf855c6967a.tar.gz samba-eeb05bf746b0eeeba94fe51180e0ebf855c6967a.tar.xz samba-eeb05bf746b0eeeba94fe51180e0ebf855c6967a.zip | |
s4:winreg RPC - don't crash when incoming data wasn't correctly specified
Also found by the WINREG torture test enhancements by gd.
Diffstat (limited to 'source4/rpc_server/winreg')
| -rw-r--r-- | source4/rpc_server/winreg/rpc_winreg.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/source4/rpc_server/winreg/rpc_winreg.c b/source4/rpc_server/winreg/rpc_winreg.c index 13c311cd96..c12c0c52e7 100644 --- a/source4/rpc_server/winreg/rpc_winreg.c +++ b/source4/rpc_server/winreg/rpc_winreg.c @@ -496,9 +496,15 @@ static WERROR dcesrv_winreg_QueryValue(struct dcesrv_call_state *dce_call, if (!W_ERROR_IS_OK(result)) { /* if the lookup wasn't successful, send client query back */ - value_type = *r->in.type; + value_type = 0; + if (r->in.type != NULL) { + value_type = *r->in.type; + } value_data.data = r->in.data; - value_data.length = *r->in.data_length; + value_data.length = 0; + if (r->in.data_length != NULL) { + value_data.length = *r->in.data_length; + } } r->out.type = talloc(mem_ctx, uint32_t); |