diff options
| author | Stefan Metzmacher <metze@samba.org> | 2011-09-14 13:04:28 +0200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2011-10-12 20:59:53 +0200 |
| commit | ddd98c187c4d89b38bafe7cd7157d47e7c45bf28 (patch) | |
| tree | f642405937819c7ffcc538bc17224cc45572491a | |
| parent | b00b678169103aa7ba550190a8ac884f39201c5a (diff) | |
| download | samba-ddd98c187c4d89b38bafe7cd7157d47e7c45bf28.tar.gz samba-ddd98c187c4d89b38bafe7cd7157d47e7c45bf28.tar.xz samba-ddd98c187c4d89b38bafe7cd7157d47e7c45bf28.zip | |
s3:smb2_server: SMB2_OP_GETINFO doesn't require at least 1 dyn byte
metze
(cherry picked from commit 563fa741f6a34a1300c81a8474ca87346a9f5cca)
(cherry picked from commit 349a7a5005609fadbec71d7a033b95757f23a59a)
| -rw-r--r-- | source3/smbd/smb2_server.c | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c index 811e6d3d65b..fbfe3e76fea 100644 --- a/source3/smbd/smb2_server.c +++ b/source3/smbd/smb2_server.c @@ -1128,9 +1128,12 @@ static NTSTATUS smbd_smb2_request_process_cancel(struct smbd_smb2_request *req) NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req, size_t expected_body_size) { + const uint8_t *inhdr; + uint16_t opcode; const uint8_t *inbody; int i = req->current_idx; size_t body_size; + size_t min_dyn_size = expected_body_size & 0x00000001; /* * The following should be checked already. @@ -1145,6 +1148,15 @@ NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req, return NT_STATUS_INTERNAL_ERROR; } + inhdr = (const uint8_t *)req->in.vector[i+0].iov_base; + opcode = SVAL(inhdr, SMB2_HDR_OPCODE); + + switch (opcode) { + case SMB2_OP_GETINFO: + min_dyn_size = 0; + break; + } + /* * Now check the expected body size, * where the last byte might be in the @@ -1153,7 +1165,7 @@ NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req, if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) { return NT_STATUS_INVALID_PARAMETER; } - if (req->in.vector[i+2].iov_len < (expected_body_size & 0x00000001)) { + if (req->in.vector[i+2].iov_len < min_dyn_size) { return NT_STATUS_INVALID_PARAMETER; } |