diff options
| author | Jeremy Allison <jra@samba.org> | 2011-09-21 11:40:01 -0700 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2011-10-12 20:56:32 +0200 |
| commit | 8a64e764bb3c79d53d4f8bd22d48e483c2f49253 (patch) | |
| tree | f642f50d5c2bede5b02b41c0baf4e092a1dc5bcd | |
| parent | 569f84eedc9bbd22ccae6230a4d7000b265d4852 (diff) | |
| download | samba-8a64e764bb3c79d53d4f8bd22d48e483c2f49253.tar.gz samba-8a64e764bb3c79d53d4f8bd22d48e483c2f49253.tar.xz samba-8a64e764bb3c79d53d4f8bd22d48e483c2f49253.zip | |
Fix bug #8474 - SMB2 create doesn't cope with an Apple client using NULL blob in create
Cope with zero length data_offset and data_length values.
Autobuild-User: Jeremy Allison <jra@samba.org>
Autobuild-Date: Wed Sep 21 22:12:40 CEST 2011 on sn-devel-104
(cherry picked from commit 2a9792f4d9963e4b4cbd38da47d8296694333269)
| -rw-r--r-- | libcli/smb/smb2_create_blob.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/libcli/smb/smb2_create_blob.c b/libcli/smb/smb2_create_blob.c index 444dc840afe..b44f28a01ff 100644 --- a/libcli/smb/smb2_create_blob.c +++ b/libcli/smb/smb2_create_blob.c @@ -63,9 +63,10 @@ NTSTATUS smb2_create_blob_parse(TALLOC_CTX *mem_ctx, const DATA_BLOB buffer, name_offset > remaining || name_length != 4 || /* windows enforces this */ name_offset + name_length > remaining || - data_offset < name_offset + name_length || - data_offset > remaining || - data_offset + (uint64_t)data_length > remaining) { + (data_offset && (data_offset < name_offset + name_length)) || + (data_offset && (data_offset > remaining)) || + (data_offset && data_length && + (data_offset + (uint64_t)data_length > remaining))) { return NT_STATUS_INVALID_PARAMETER; } @@ -88,6 +89,9 @@ NTSTATUS smb2_create_blob_parse(TALLOC_CTX *mem_ctx, const DATA_BLOB buffer, data += next; if (remaining < 16) { + DEBUG(0,("smb2_create_blob_parse: remaining1 = %d, next = %d\n", + (int)remaining, + (int)next)); return NT_STATUS_INVALID_PARAMETER; } } |