Changeset 134 for branches/samba-3.0/source/smbd/trans2.c

Timestamp:

May 23, 2008, 6:56:41 AM (17 years ago)

Author:

Paul Smedley

Message:

Update source to 3.0.29

File:

• branches/samba-3.0/source/smbd/trans2.c (modified) (6 diffs)

branches/samba-3.0/source/smbd/trans2.c

@@ -6594 +6594 @@
         unsigned int pscnt = SVAL(inbuf, smb_pscnt);
         unsigned int tran_call = SVAL(inbuf, smb_setup0);
+        unsigned int av_size = size-4;
         struct trans_state *state;
         NTSTATUS result;
@@ -6675 +6676 @@
                         return(ERROR_DOS(ERRDOS,ERRnomem));
                 }
-                if ((dsoff+dscnt < dsoff) || (dsoff+dscnt < dscnt))
+
+                if (dscnt > state->total_data ||
+                                dsoff+dscnt < dsoff) {
                         goto bad_param;
-                if ((smb_base(inbuf)+dsoff+dscnt > inbuf + size) ||
-                    (smb_base(inbuf)+dsoff+dscnt < smb_base(inbuf)))
-                        goto bad_param;
+                }
+
+                if (dsoff > av_size ||
+                                dscnt > av_size ||
+                                dsoff+dscnt > av_size) {
+                                goto bad_param;
+                }
 
                 memcpy(state->data,smb_base(inbuf)+dsoff,dscnt);
@@ -6696 +6703 @@
                         return(ERROR_DOS(ERRDOS,ERRnomem));
                 } 
-                if ((psoff+pscnt < psoff) || (psoff+pscnt < pscnt))
+
+                if (pscnt > state->total_param ||
+                                psoff+pscnt < psoff) {
                         goto bad_param;
-                if ((smb_base(inbuf)+psoff+pscnt > inbuf + size) ||
-                    (smb_base(inbuf)+psoff+pscnt < smb_base(inbuf)))
+                }
+
+                if (psoff > av_size ||
+                                pscnt > av_size ||
+                                psoff+pscnt > av_size) {
                         goto bad_param;
+                }
 
                 memcpy(state->param,smb_base(inbuf)+psoff,pscnt);
@@ -6749 +6762 @@
         int outsize = 0;
         unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
+        unsigned int av_size = size-4;
         struct trans_state *state;
 
@@ -6791 +6805 @@
 
         if (pcnt) {
-                if (pdisp+pcnt > state->total_param)
+                if (pdisp > state->total_param ||
+                                pcnt > state->total_param ||
+                                pdisp+pcnt > state->total_param ||
+                                pdisp+pcnt < pdisp) {
                         goto bad_param;
-                if ((pdisp+pcnt < pdisp) || (pdisp+pcnt < pcnt))
+                }
+
+                if (poff > av_size ||
+                                pcnt > av_size ||
+                                poff+pcnt > av_size ||
+                                poff+pcnt < poff) {
                         goto bad_param;
-                if (pdisp > state->total_param)
-                        goto bad_param;
-                if ((smb_base(inbuf) + poff + pcnt > inbuf + size) ||
-                    (smb_base(inbuf) + poff + pcnt < smb_base(inbuf)))
-                        goto bad_param;
-                if (state->param + pdisp < state->param)
-                        goto bad_param;
+                }
 
                 memcpy(state->param+pdisp,smb_base(inbuf)+poff,
@@ -6808 +6824 @@
 
         if (dcnt) {
-                if (ddisp+dcnt > state->total_data)
+                if (ddisp > state->total_data ||
+                                dcnt > state->total_data ||
+                                ddisp+dcnt > state->total_data ||
+                                ddisp+dcnt < ddisp) {
                         goto bad_param;
-                if ((ddisp+dcnt < ddisp) || (ddisp+dcnt < dcnt))
+                }
+
+                if (ddisp > av_size ||
+                                dcnt > av_size ||
+                                ddisp+dcnt > av_size ||
+                                ddisp+dcnt < ddisp) {
                         goto bad_param;
-                if (ddisp > state->total_data)
-                        goto bad_param;
-                if ((smb_base(inbuf) + doff + dcnt > inbuf + size) ||
-                    (smb_base(inbuf) + doff + dcnt < smb_base(inbuf)))
-                        goto bad_param;
-                if (state->data + ddisp < state->data)
-                        goto bad_param;
+                }
 
                 memcpy(state->data+ddisp, smb_base(inbuf)+doff,