From a0d850515796328d92ca42032c765afce477e039 Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Sat, 8 Nov 2008 17:14:06 +0100 Subject: [PATCH] Fix the offset checks in the trans routines This fixes a potential crash bug, a client can make us read memory we should not read. Luckily I got the disp checks right... Volker --- source/smbd/ipc.c | 8 ++++---- source/smbd/nttrans.c | 6 +++--- source/smbd/trans2.c | 6 +++--- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/source/smbd/ipc.c b/source/smbd/ipc.c index f7b7c3132bd..43f0d69f243 100644 --- a/source/smbd/ipc.c +++ b/source/smbd/ipc.c @@ -680,13 +680,13 @@ int reply_transs(connection_struct *conn, char *inbuf,char *outbuf, dcnt > state->total_data || ddisp+dcnt > state->total_data || ddisp+dcnt < ddisp) { - goto bad_param; + goto bad_param; } - if (ddisp > av_size || + if (doff > av_size || dcnt > av_size || - ddisp+dcnt > av_size || - ddisp+dcnt < ddisp) { + doff+dcnt > av_size || + doff+dcnt < doff) { goto bad_param; } diff --git a/source/smbd/nttrans.c b/source/smbd/nttrans.c index b40ea9edca1..2b9d5daa4fd 100644 --- a/source/smbd/nttrans.c +++ b/source/smbd/nttrans.c @@ -3228,10 +3228,10 @@ int reply_nttranss(connection_struct *conn, char *inbuf,char *outbuf, goto bad_param; } - if (ddisp > av_size || + if (doff > av_size || dcnt > av_size || - ddisp+dcnt > av_size || - ddisp+dcnt < ddisp) { + doff+dcnt > av_size || + doff+dcnt < doff) { goto bad_param; } diff --git a/source/smbd/trans2.c b/source/smbd/trans2.c index 30c84bf6615..9daef90115f 100644 --- a/source/smbd/trans2.c +++ b/source/smbd/trans2.c @@ -6822,10 +6822,10 @@ int reply_transs2(connection_struct *conn, goto bad_param; } - if (ddisp > av_size || + if (doff > av_size || dcnt > av_size || - ddisp+dcnt > av_size || - ddisp+dcnt < ddisp) { + doff+dcnt > av_size || + doff+dcnt < doff) { goto bad_param; } -- 2.11.4.GIT