Changeset 587 for vendor/current/source3/libsmb/nmblib.c

Timestamp:

Jun 29, 2011, 7:36:41 AM (14 years ago)

Author:

Herwig Bauernfeind

Message:

Samba 3.5: Update vendor to version 3.5.6

File:

• vendor/current/source3/libsmb/nmblib.c (modified) (4 diffs)

vendor/current/source3/libsmb/nmblib.c

@@ -1238 +1238 @@
 /****************************************************************************
  Interpret the weird netbios "name" into a unix fstring. Return the name type.
+ Returns -1 on error.
 ****************************************************************************/
 
-static int name_interpret(char *in, fstring name)
-{
+static int name_interpret(unsigned char *buf, size_t buf_len,
+                unsigned char *in, fstring name)
+{
+        unsigned char *end_ptr = buf + buf_len;
         int ret;
-        int len = (*in++) / 2;
+        unsigned int len;
         fstring out_string;
-        char *out = out_string;
+        unsigned char *out = (unsigned char *)out_string;
 
         *out=0;
 
-        if (len > 30 || len<1)
-                return(0);
+        if (in >= end_ptr) {
+                return -1;
+        }
+        len = (*in++) / 2;
+
+        if (len<1) {
+                return -1;
+        }
 
         while (len--) {
+                if (&in[1] >= end_ptr) {
+                        return -1;
+                }
                 if (in[0] < 'A' || in[0] > 'P' || in[1] < 'A' || in[1] > 'P') {
                         *out = 0;
@@ -1260 +1272 @@
                 in += 2;
                 out++;
+                if (PTR_DIFF(out,out_string) >= sizeof(fstring)) {
+                        return -1;
+                }
         }
         ret = out[-1];
         out[-1] = 0;
 
-#ifdef NETBIOS_SCOPE
-        /* Handle any scope names */
-        while(*in) {
-                *out++ = '.'; /* Scope names are separated by periods */
-                len = *(unsigned char *)in++;
-                StrnCpy(out, in, len);
-                out += len;
-                *out=0;
-                in += len;
-        }
-#endif
         pull_ascii_fstring(name, out_string);
 
@@ -1353 +1357 @@
 ****************************************************************************/
 
-static char *name_ptr(char *buf,int ofs)
-{
-        unsigned char c = *(unsigned char *)(buf+ofs);
-
+static unsigned char *name_ptr(unsigned char *buf, size_t buf_len, unsigned int ofs)
+{
+        unsigned char c = 0;
+
+        if (ofs > buf_len || buf_len < 1) {
+                return NULL;
+        }
+
+        c = *(unsigned char *)(buf+ofs);
         if ((c & 0xC0) == 0xC0) {
-                uint16 l = RSVAL(buf, ofs) & 0x3FFF;
+                uint16 l = 0;
+
+                if (ofs > buf_len - 1) {
+                        return NULL;
+                }
+                l = RSVAL(buf, ofs) & 0x3FFF;
+                if (l > buf_len) {
+                        return NULL;
+                }
                 DEBUG(5,("name ptr to pos %d from %d is %s\n",l,ofs,buf+l));
                 return(buf + l);
@@ -1368 +1385 @@
 /****************************************************************************
  Extract a netbios name from a buf (into a unix string) return name type.
+ Returns -1 on error.
 ****************************************************************************/
 
-int name_extract(char *buf,int ofs, fstring name)
-{
-        char *p = name_ptr(buf,ofs);
-        int d = PTR_DIFF(p,buf+ofs);
+int name_extract(unsigned char *buf, size_t buf_len, unsigned int ofs, fstring name)
+{
+        unsigned char *p = name_ptr(buf,buf_len,ofs);
 
         name[0] = '\0';
-        if (d < -50 || d > 50)
-                return(0);
-        return(name_interpret(p,name));
+        if (p == NULL) {
+                return -1;
+        }
+        return(name_interpret(buf,buf_len,p,name));
 }
 
 /****************************************************************************
  Return the total storage length of a mangled name.
+ Returns -1 on error.
 ****************************************************************************/
 
-int name_len(char *s1)
+int name_len(unsigned char *s1, size_t buf_len)
 {
         /* NOTE: this argument _must_ be unsigned */
         unsigned char *s = (unsigned char *)s1;
-        int len;
-
+        int len = 0;
+
+        if (buf_len < 1) {
+                return -1;
+        }
         /* If the two high bits of the byte are set, return 2. */
-        if (0xC0 == (*s & 0xC0))
+        if (0xC0 == (*s & 0xC0)) {
+                if (buf_len < 2) {
+                        return -1;
+                }
                 return(2);
+        }
 
         /* Add up the length bytes. */
         for (len = 1; (*s); s += (*s) + 1) {
                 len += *s + 1;
-                SMB_ASSERT(len < 80);
+                if (len > buf_len) {
+                        return -1;
+                }
         }