diff options
| author | Stefan Metzmacher <metze@samba.org> | 2013-12-06 13:52:09 +0100 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2014-03-05 10:06:24 -0800 |
| commit | cce1eaea91088efd742891befdaafade0c1fdce6 (patch) | |
| tree | 22f475e48e0fd7599d4318051b8129a94b8ac128 /source3 | |
| parent | 5cd5c1613996ecebdcd632e932957947f4c27308 (diff) | |
| download | samba-cce1eaea91088efd742891befdaafade0c1fdce6.tar.gz samba-cce1eaea91088efd742891befdaafade0c1fdce6.tar.xz samba-cce1eaea91088efd742891befdaafade0c1fdce6.zip | |
s3:smbd: reject a MaxBufferSize < SMB_BUFFER_SIZE_MIN (500) in a session setup request
This makes sure sconn->smb1.sessions.max_send is always >= SMB_BUFFER_SIZE_MIN.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10422
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Diffstat (limited to 'source3')
| -rw-r--r-- | source3/smbd/sesssetup.c | 19 |
1 files changed, 13 insertions, 6 deletions
diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c index 02cb4458f61..4b86a99522f 100644 --- a/source3/smbd/sesssetup.c +++ b/source3/smbd/sesssetup.c @@ -383,10 +383,13 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req) } if (!sconn->smb1.sessions.done_sesssetup) { - sconn->smb1.sessions.max_send = - MIN(sconn->smb1.sessions.max_send,smb_bufsize); + if (smb_bufsize < SMB_BUFFER_SIZE_MIN) { + reply_force_doserror(req, ERRSRV, ERRerror); + return; + } + sconn->smb1.sessions.max_send = smb_bufsize; + sconn->smb1.sessions.done_sesssetup = true; } - sconn->smb1.sessions.done_sesssetup = true; /* current_user_info is changed on new vuid */ reload_services(sconn, conn_snum_used, true); @@ -1088,10 +1091,14 @@ void reply_sesssetup_and_X(struct smb_request *req) req->vuid = sess_vuid; if (!sconn->smb1.sessions.done_sesssetup) { - sconn->smb1.sessions.max_send = - MIN(sconn->smb1.sessions.max_send,smb_bufsize); + if (smb_bufsize < SMB_BUFFER_SIZE_MIN) { + reply_force_doserror(req, ERRSRV, ERRerror); + END_PROFILE(SMBsesssetupX); + return; + } + sconn->smb1.sessions.max_send = smb_bufsize; + sconn->smb1.sessions.done_sesssetup = true; } - sconn->smb1.sessions.done_sesssetup = true; END_PROFILE(SMBsesssetupX); } |