diff options
| author | Jeremy Allison <jra@samba.org> | 2000-05-17 19:17:16 +0000 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2000-05-17 19:17:16 +0000 |
| commit | aa1a4f46da9584240cd6cee6fb652aa73e77015c (patch) | |
| tree | 6b3171a1f45b2de0d937cd3e799e8c853f369e10 /source/rpc_server/srv_pipe_hnd.c | |
| parent | 83b787f57e8e97ee4d3782e76c3fd003ed567885 (diff) | |
| download | samba-aa1a4f46da9584240cd6cee6fb652aa73e77015c.tar.gz samba-aa1a4f46da9584240cd6cee6fb652aa73e77015c.tar.xz samba-aa1a4f46da9584240cd6cee6fb652aa73e77015c.zip | |
Fixed bug I introduced last night (sorry). Now truncate incoming prs_struct
buffer size to exact size of incoming data to prevent read overruns into slop
space.
Jeremy.
Diffstat (limited to 'source/rpc_server/srv_pipe_hnd.c')
| -rw-r--r-- | source/rpc_server/srv_pipe_hnd.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/source/rpc_server/srv_pipe_hnd.c b/source/rpc_server/srv_pipe_hnd.c index f19aed18865..a349da839a6 100644 --- a/source/rpc_server/srv_pipe_hnd.c +++ b/source/rpc_server/srv_pipe_hnd.c @@ -476,6 +476,13 @@ authentication failed. Denying the request.\n", p->name)); */ /* + * Ensure the internal prs buffer size is *exactly* the same + * size as the current offset. + */ + + prs_set_buffer_size(&p->in_data.data, prs_offset(&p->in_data.data)); + + /* * Set the parse offset to the start of the data and set the * prs_struct to UNMARSHALL. */ |