From e334563f48f85b1580638d3dd444c2f9c97f05af Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Sat, 8 Nov 2008 17:14:06 +0100 Subject: [PATCH] Fix the offset checks in the trans routines This fixes a potential crash bug, a client can make us read memory we should not read. Luckily I got the disp checks right... Volker --- source/smbd/ipc.c | 6 +++--- source/smbd/nttrans.c | 6 +++--- source/smbd/trans2.c | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/source/smbd/ipc.c b/source/smbd/ipc.c index 6961a5c..a53bc5b 100644 --- a/source/smbd/ipc.c +++ b/source/smbd/ipc.c @@ -764,10 +764,10 @@ void reply_transs(struct smb_request *req) goto bad_param; } - if (ddisp > av_size || + if (doff > av_size || dcnt > av_size || - ddisp+dcnt > av_size || - ddisp+dcnt < ddisp) { + doff+dcnt > av_size || + doff+dcnt < doff) { goto bad_param; } diff --git a/source/smbd/nttrans.c b/source/smbd/nttrans.c index 13caf77..ef81404 100644 --- a/source/smbd/nttrans.c +++ b/source/smbd/nttrans.c @@ -2853,10 +2853,10 @@ void reply_nttranss(struct smb_request *req) goto bad_param; } - if (ddisp > av_size || + if (doff > av_size || dcnt > av_size || - ddisp+dcnt > av_size || - ddisp+dcnt < ddisp) { + doff+dcnt > av_size || + doff+dcnt < doff) { goto bad_param; } diff --git a/source/smbd/trans2.c b/source/smbd/trans2.c index acc424f..c7edec1 100644 --- a/source/smbd/trans2.c +++ b/source/smbd/trans2.c @@ -7785,10 +7785,10 @@ void reply_transs2(struct smb_request *req) goto bad_param; } - if (ddisp > av_size || + if (doff > av_size || dcnt > av_size || - ddisp+dcnt > av_size || - ddisp+dcnt < ddisp) { + doff+dcnt > av_size || + doff+dcnt < doff) { goto bad_param; } -- 1.5.5