diff options
| author | Gerald Carter <jerry@samba.org> | 2007-05-14 14:24:52 +0000 |
|---|---|---|
| committer | Gerald Carter <jerry@samba.org> | 2007-05-14 14:24:52 +0000 |
| commit | c3f0e56c057f6be60bd3721485f013ed63defa6a (patch) | |
| tree | 912f4dfedfc0303371a02b2ec9f77e1328c0b0ee /source/rpc_parse/parse_spoolss.c | |
| parent | e6549096bedeac730cacbcaffddd6f907e4c9e28 (diff) | |
| download | samba-3.0.25.tar.gz samba-3.0.25.tar.xz samba-3.0.25.zip | |
r22853: checkin pending security fixes and release notes updates for Samba 3.0.25samba-3.0.25
Diffstat (limited to 'source/rpc_parse/parse_spoolss.c')
| -rw-r--r-- | source/rpc_parse/parse_spoolss.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/source/rpc_parse/parse_spoolss.c b/source/rpc_parse/parse_spoolss.c index ae82f9c1164..060b53f44a9 100644 --- a/source/rpc_parse/parse_spoolss.c +++ b/source/rpc_parse/parse_spoolss.c @@ -230,6 +230,10 @@ static BOOL smb_io_notify_option_type_data(const char *desc, SPOOL_NOTIFY_OPTION if (type->count2 != type->count) DEBUG(4,("What a mess, count was %x now is %x !\n", type->count, type->count2)); + if (type->count2 > MAX_NOTIFY_TYPE_FOR_NOW) { + return False; + } + /* parse the option type data */ for(i=0;i<type->count2;i++) if(!prs_uint16("fields",ps,depth,&type->fields[i])) |