| commit | af715c602a8ef6038e6272c7cc6a08501617ae67 | |
| author | Jeremy Allison <jra@samba.org> | |
| Mon, 9 Jul 2007 00:48:07 +0000 (9 00:48 +0000) | ||
| committer | Gerald (Jerry) Carter <jerry@samba.org> | |
| Wed, 10 Oct 2007 17:23:52 +0000 (10 12:23 -0500) | ||
| tree | 83db2e3ee27ca70dbc72ed58ec84c8264620ca45 | treesnapshot (tar.gz zip) |
| parent | b68856d9902f41079224ba11c7d0ab811b082201 | commitdiff |
r23752: Fix bug introduced by checkin 22920, allow large
readX. Fix from Dmitry Shatrov <dhsatrov@linux.vnet.ibm.com>.
"In send_file_readX(), if startpos > sbuf.st_size, then smb_maxcnt is set
to an invalid large value due to integer overflow.
As for me, this resulted in MS Word hanging while trying to save
a 1.5Mb document."
This isn't in shipping code.
Jeremy.
readX. Fix from Dmitry Shatrov <dhsatrov@linux.vnet.ibm.com>.
"In send_file_readX(), if startpos > sbuf.st_size, then smb_maxcnt is set
to an invalid large value due to integer overflow.
As for me, this resulted in MS Word hanging while trying to save
a 1.5Mb document."
This isn't in shipping code.
Jeremy.
| source/smbd/reply.c | diffblobblamehistory |