diff options
| author | Andrew Tridgell <tridge@samba.org> | 2005-06-30 01:34:53 +0000 |
|---|---|---|
| committer | Gerald (Jerry) Carter <jerry@samba.org> | 2007-10-10 13:18:57 -0500 |
| commit | 1050a54a3bb125af401f27cf0eb5a0ab51b085ea (patch) | |
| tree | 0e9af0686ef1a9dc167a406658479b0c5862f55c /source4 | |
| parent | c58c7c416412fd2ae90427f500b2d94996c36c48 (diff) | |
| download | samba-1050a54a3bb125af401f27cf0eb5a0ab51b085ea.tar.gz samba-1050a54a3bb125af401f27cf0eb5a0ab51b085ea.tar.xz samba-1050a54a3bb125af401f27cf0eb5a0ab51b085ea.zip | |
r8003: ensure that we don't try to send a trans request with more than 64k data or params
(This used to be commit b4f2d17ace6a609ec87da103a89e36edee8903f9)
Diffstat (limited to 'source4')
| -rw-r--r-- | source4/libcli/raw/rawtrans.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/source4/libcli/raw/rawtrans.c b/source4/libcli/raw/rawtrans.c index 118ac5e3fdf..b523232bc05 100644 --- a/source4/libcli/raw/rawtrans.c +++ b/source4/libcli/raw/rawtrans.c @@ -216,6 +216,14 @@ struct smbcli_request *smb_raw_trans_send_backend(struct smbcli_tree *tree, size_t namelen = 0; uint16_t data_disp, data_length, max_data; + if (parms->in.params.length > UINT16_MAX || + parms->in.data.length > UINT16_MAX) { + DEBUG(3,("Attempt to send invalid trans2 request (params %u, data %u)\n", + parms->in.params.length, parms->in.data.length)); + return NULL; + } + + if (command == SMBtrans) padding = 1; else |