From 8aae8b5bad167ac732b7f8949dfb40aebb2f26a9 Mon Sep 17 00:00:00 2001 From: Ralph Wuerthner Date: Thu, 4 Apr 2013 13:29:01 +0200 Subject: [PATCH] s3:smbd: do not access data behind req->buf+req->buflen in srvstr_pull_req_talloc() Reviewed-by: Volker Lendecke Reviewed-by: Michael Adam Autobuild-User(master): Michael Adam Autobuild-Date(master): Wed Apr 10 02:03:13 CEST 2013 on sn-devel-104 --- source3/smbd/reply.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c index 274807beb96..79aaf76043e 100644 --- a/source3/smbd/reply.c +++ b/source3/smbd/reply.c @@ -347,8 +347,14 @@ size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req, size_t srvstr_pull_req_talloc(TALLOC_CTX *ctx, struct smb_request *req, char **dest, const char *src, int flags) { + ssize_t bufrem = smbreq_bufrem(req, src); + + if (bufrem < 0) { + return 0; + } + return pull_string_talloc(ctx, req->inbuf, req->flags2, dest, src, - smbreq_bufrem(req, src), flags); + bufrem, flags); } /**************************************************************************** -- 2.11.4.GIT