Changeset 694

Timestamp:

Mar 12, 2012, 8:25:09 AM (13 years ago)

Author:

Herwig Bauernfeind

Message:

Update Samba 3.3 with CVE-2012-0870 security patch

File:

• branches/samba-3.3.x/source/smbd/process.c (modified) (2 diffs)

branches/samba-3.3.x/source/smbd/process.c

@@ -1657 +1657 @@
 
         int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
-        unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
+        static unsigned smb_off2;
         char *inbuf2;
         int outsize2;
@@ -1682 +1682 @@
                 orig_inbuf = inbuf;
                 orig_size = size;
-        }
-
+                smb_off2 = 0;
+        }
+  
+        if (SVAL(inbuf,smb_vwv1) <= smb_off2) {
+                DEBUG(1, ("AndX offset not increasing\n"));
+                SCVAL(outbuf, smb_vwv0, 0xFF);
+                return;
+        }
+        smb_off2 = SVAL(inbuf, smb_vwv1);
+ 
         /* Validate smb_off2 */
         if ((smb_off2 < smb_wct - 4) || orig_size < (smb_off2 + 4 - smb_wct)) {