| commit | 0691890ccdcb655ee31cb708c689630c9c0c6fd2 | |
| author | Ralph Boehme <slow@samba.org> | |
| Thu, 25 Jun 2015 13:42:04 +0000 (25 15:42 +0200) | ||
| committer | Karolin Seeger <kseeger@samba.org> | |
| Sun, 5 Jul 2015 19:30:17 +0000 (5 21:30 +0200) | ||
| tree | df3e3b35661f1d15f672e5417f44d710d056b763 | treesnapshot (tar.gz zip) |
| parent | a70531c378c320e13758dc089c711f6e0425bfd2 | commitdiff |
vfs_fruit: check offset and length for AFP_AfpInfo read requests
fruit_pread doesn't check the offset and length parameters and instead
always writes 60 bytes, the size of the AFP_AfpInfo blob, to the the
passed buffer. If the passed in buffer is smaller, we overwrite
something somewhere.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=11363
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit 25f302a47c3119d454531dc992183552b9a42b13)
fruit_pread doesn't check the offset and length parameters and instead
always writes 60 bytes, the size of the AFP_AfpInfo blob, to the the
passed buffer. If the passed in buffer is smaller, we overwrite
something somewhere.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=11363
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit 25f302a47c3119d454531dc992183552b9a42b13)
| source3/modules/vfs_fruit.c | diffblobblamehistory |