From c3f0e56c057f6be60bd3721485f013ed63defa6a Mon Sep 17 00:00:00 2001
From: Gerald Carter <jerry@samba.org>
Date: Mon, 14 May 2007 14:24:52 +0000
Subject: r22853: checkin pending security fixes and release notes updates for
 Samba 3.0.25

---
 source/rpc_parse/parse_spoolss.c | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'source/rpc_parse/parse_spoolss.c')

diff --git a/source/rpc_parse/parse_spoolss.c b/source/rpc_parse/parse_spoolss.c
index ae82f9c1164..060b53f44a9 100644
--- a/source/rpc_parse/parse_spoolss.c
+++ b/source/rpc_parse/parse_spoolss.c
@@ -230,6 +230,10 @@ static BOOL smb_io_notify_option_type_data(const char *desc, SPOOL_NOTIFY_OPTION
 	if (type->count2 != type->count)
 		DEBUG(4,("What a mess, count was %x now is %x !\n", type->count, type->count2));
 
+	if (type->count2 > MAX_NOTIFY_TYPE_FOR_NOW) {
+		return False;
+	}
+
 	/* parse the option type data */
 	for(i=0;i<type->count2;i++)
 		if(!prs_uint16("fields",ps,depth,&type->fields[i]))
-- 
cgit