Changeset 134 for branches/samba-3.0/source/smbd/ipc.c

Timestamp:

May 23, 2008, 6:56:41 AM (17 years ago)

Author:

Paul Smedley

Message:

Update source to 3.0.29

File:

• branches/samba-3.0/source/smbd/ipc.c (modified) (6 diffs)

branches/samba-3.0/source/smbd/ipc.c

@@ -435 +435 @@
         unsigned int psoff = SVAL(inbuf, smb_psoff);
         unsigned int pscnt = SVAL(inbuf, smb_pscnt);
+        unsigned int av_size = size-4;
         struct trans_state *state;
         NTSTATUS result;
@@ -490 +491 @@
                 /* null-terminate the slack space */
                 memset(&state->data[state->total_data], 0, 100);
-                if ((dsoff+dscnt < dsoff) || (dsoff+dscnt < dscnt))
-                        goto bad_param;
-                if ((smb_base(inbuf)+dsoff+dscnt > inbuf + size) ||
-                    (smb_base(inbuf)+dsoff+dscnt < smb_base(inbuf)))
-                        goto bad_param;
+
+                if (dscnt > state->total_data ||
+                                dsoff+dscnt < dsoff) {
+                        goto bad_param;
+                }
+
+                if (dsoff > av_size ||
+                                dscnt > av_size ||
+                                dsoff+dscnt > av_size) {
+                        goto bad_param;
+                }
 
                 memcpy(state->data,smb_base(inbuf)+dsoff,dscnt);
@@ -513 +520 @@
                 /* null-terminate the slack space */
                 memset(&state->param[state->total_param], 0, 100);
-                if ((psoff+pscnt < psoff) || (psoff+pscnt < pscnt))
-                        goto bad_param;
-                if ((smb_base(inbuf)+psoff+pscnt > inbuf + size) ||
-                    (smb_base(inbuf)+psoff+pscnt < smb_base(inbuf)))
-                        goto bad_param;
+
+                if (pscnt > state->total_param ||
+                                psoff+pscnt < psoff) {
+                        goto bad_param;
+                }
+
+                if (psoff > av_size ||
+                                pscnt > av_size ||
+                                psoff+pscnt > av_size) {
+                        goto bad_param;
+                }
 
                 memcpy(state->param,smb_base(inbuf)+psoff,pscnt);
@@ -601 +614 @@
         int outsize = 0;
         unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
+        unsigned int av_size = size-4;
         struct trans_state *state;
         NTSTATUS result;
@@ -644 +658 @@
                 
         if (pcnt) {
-                if (pdisp+pcnt > state->total_param)
-                        goto bad_param;
-                if ((pdisp+pcnt < pdisp) || (pdisp+pcnt < pcnt))
-                        goto bad_param;
-                if (pdisp > state->total_param)
-                        goto bad_param;
-                if ((smb_base(inbuf) + poff + pcnt > inbuf + size) ||
-                    (smb_base(inbuf) + poff + pcnt < smb_base(inbuf)))
-                        goto bad_param;
-                if (state->param + pdisp < state->param)
-                        goto bad_param;
+                if (pdisp > state->total_param ||
+                                pcnt > state->total_param ||
+                                pdisp+pcnt > state->total_param ||
+                                pdisp+pcnt < pdisp) {
+                        goto bad_param;
+                }
+
+                if (poff > av_size ||
+                                pcnt > av_size ||
+                                poff+pcnt > av_size ||
+                                poff+pcnt < poff) {
+                        goto bad_param;
+                }
 
                 memcpy(state->param+pdisp,smb_base(inbuf)+poff,
@@ -661 +677 @@
 
         if (dcnt) {
-                if (ddisp+dcnt > state->total_data)
-                        goto bad_param;
-                if ((ddisp+dcnt < ddisp) || (ddisp+dcnt < dcnt))
-                        goto bad_param;
-                if (ddisp > state->total_data)
-                        goto bad_param;
-                if ((smb_base(inbuf) + doff + dcnt > inbuf + size) ||
-                    (smb_base(inbuf) + doff + dcnt < smb_base(inbuf)))
-                        goto bad_param;
-                if (state->data + ddisp < state->data)
-                        goto bad_param;
+                if (ddisp > state->total_data ||
+                                dcnt > state->total_data ||
+                                ddisp+dcnt > state->total_data ||
+                                ddisp+dcnt < ddisp) {
+                        goto bad_param; 
+                }
+
+                if (ddisp > av_size ||
+                                dcnt > av_size ||
+                                ddisp+dcnt > av_size ||
+                                ddisp+dcnt < ddisp) {
+                        goto bad_param;
+                }
 
                 memcpy(state->data+ddisp, smb_base(inbuf)+doff,