Changeset 467 for branches/samba-3.3.x/source/smbd

Timestamp:

Jun 17, 2010, 10:59:42 AM (15 years ago)

Author:

Herwig Bauernfeind

Message:

Update Samba 3.3 to 3.3.13 (security update)

File:

• branches/samba-3.3.x/source/smbd/process.c (modified) (2 diffs)

branches/samba-3.3.x/source/smbd/process.c

@@ -1646 +1646 @@
 {
         static char *orig_inbuf;
+        static int orig_size;
 
         /*
@@ -1680 +1681 @@
                 /* this is the first part of the chain */
                 orig_inbuf = inbuf;
-        }
-
+                orig_size = size;
+        }
+
+        /* Validate smb_off2 */
+        if ((smb_off2 < smb_wct - 4) || orig_size < (smb_off2 + 4 - smb_wct)) {
+                exit_server_cleanly("Bad chained packet");
+                return;
+        }
         /*
          * We need to save the output the caller added to the chain so that we
          * can splice it into the final output buffer later.
          */
+
+        if (outsize <= smb_wct) {
+                exit_server_cleanly("Bad chained packet");
+                return;
+        }
 
         caller_outputlen = outsize - smb_wct;