diff options
| author | Jeremy Allison <jra@samba.org> | 2001-03-03 06:47:37 +0000 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2001-03-03 06:47:37 +0000 |
| commit | 65275e73ee7c58352ee20175cbbb43378e16f417 (patch) | |
| tree | b73419b648fed20d1233765fc3981cc336d7e52a | |
| parent | 57a9340cbafa40f3a41e6c676c6f2477855fd799 (diff) | |
| download | samba-65275e73ee7c58352ee20175cbbb43378e16f417.tar.gz samba-65275e73ee7c58352ee20175cbbb43378e16f417.tar.xz samba-65275e73ee7c58352ee20175cbbb43378e16f417.zip | |
Fixed up overrun read when marshelling SYSTEMTIME struct. This was a subtle one...
Jeremy.
| -rw-r--r-- | source/rpc_server/srv_spoolss_nt.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/source/rpc_server/srv_spoolss_nt.c b/source/rpc_server/srv_spoolss_nt.c index 830f5cdcf45..5c400522951 100644 --- a/source/rpc_server/srv_spoolss_nt.c +++ b/source/rpc_server/srv_spoolss_nt.c @@ -1996,12 +1996,13 @@ static void spoolss_notify_submitted_time(int snum, { struct tm *t; uint32 len; + SYSTEMTIME st; t=gmtime(&queue->time); len = sizeof(SYSTEMTIME); - data->notify_data.data.length = len; + data->notify_data.data.length = len/2 - 1; data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len); if (!data->notify_data.data.string) { @@ -2009,7 +2010,8 @@ static void spoolss_notify_submitted_time(int snum, return; } - make_systemtime((SYSTEMTIME*)(data->notify_data.data.string), t); + make_systemtime(&st, t); + memcpy(data->notify_data.data.string,&st,len); } #define END 65535 |