Changeset 988 for vendor/current/source3/libsmb/nmblib.c

Timestamp:

Nov 24, 2016, 1:14:11 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.3

File:

• vendor/current/source3/libsmb/nmblib.c (modified) (25 diffs)

vendor/current/source3/libsmb/nmblib.c

@@ -69 +69 @@
                 res->ttl ) );
 
-        if( res->rdlength == 0 || res->rdata == NULL )
+        if (res->rdlength == 0) {
                 return;
+        }
 
         for (i = 0; i < res->rdlength; i+= MAX_NETBIOSNAME_LEN) {
@@ -289 +290 @@
 ******************************************************************/
 
-static int put_nmb_name(char *buf,int offset,struct nmb_name *name)
+static int put_nmb_name(char *buf, size_t buflen, int offset,struct nmb_name *name)
 {
         int ret,m;
@@ -303 +304 @@
 
         if (buf) {
+                if (offset >= buflen) {
+                        return 0;
+                }
                 buf[offset] = 0x20;
         }
@@ -310 +314 @@
         for (m=0;m<MAX_NETBIOSNAME_LEN;m++) {
                 if (buf) {
+                        if (offset+2+2*m >= buflen) {
+                                return 0;
+                        }
                         buf[offset+1+2*m] = 'A' + ((buf1[m]>>4)&0xF);
                         buf[offset+2+2*m] = 'A' + (buf1[m]&0xF);
@@ -317 +324 @@
 
         if (buf) {
+                if (offset >= buflen) {
+                        return 0;
+                }
                 buf[offset] = 0;
         }
@@ -322 +332 @@
         if (name->scope[0]) {
                 /* XXXX this scope handling needs testing */
-                ret += strlen(name->scope) + 1;
+                size_t scopenamelen = strlen(name->scope) + 1;
+                ret += scopenamelen;
                 if (buf) {
-                        safe_strcpy(&buf[offset+1],name->scope,
-                                        sizeof(name->scope));
+                        if (offset+1+scopenamelen >= buflen) {
+                                return 0;
+                        }
+                        strlcpy(&buf[offset+1],name->scope,
+                                        buflen - (offset+1));
 
                         p = &buf[offset+1];
@@ -331 +345 @@
                                 buf[offset] = PTR_DIFF(p,&buf[offset+1]);
                                 offset += (buf[offset] + 1);
+                                if (offset+1 >= buflen) {
+                                        return 0;
+                                }
                                 p = &buf[offset+1];
                         }
@@ -405 +422 @@
 ******************************************************************/
 
-static int put_res_rec(char *buf,int offset,struct res_rec *recs,int count)
+static int put_res_rec(char *buf, size_t buflen, int offset,struct res_rec *recs,int count)
 {
         int ret=0;
@@ -411 +428 @@
 
         for (i=0;i<count;i++) {
-                int l = put_nmb_name(buf,offset,&recs[i].rr_name);
+                int l = put_nmb_name(buf,buflen,offset,&recs[i].rr_name);
                 offset += l;
                 ret += l;
@@ -888 +905 @@
                         dgram->header.msg_type == 0x11 ||
                         dgram->header.msg_type == 0x12) {
-                offset += put_nmb_name((char *)ubuf,offset,&dgram->source_name);
-                offset += put_nmb_name((char *)ubuf,offset,&dgram->dest_name);
+                offset += put_nmb_name((char *)ubuf,len,offset,&dgram->source_name);
+                offset += put_nmb_name((char *)ubuf,len,offset,&dgram->dest_name);
         }
 
@@ -918 +935 @@
         memset( (char *)n, '\0', sizeof(struct nmb_name) );
         fstrcpy(unix_name, name);
-        strupper_m(unix_name);
+        (void)strupper_m(unix_name);
         push_ascii(n->name, unix_name, sizeof(n->name), STR_TERMINATE);
         n->name_type = (unsigned int)type & 0xFF;
-        push_ascii(n->scope,  global_scope(), 64, STR_TERMINATE);
+        push_ascii(n->scope,  lp_netbios_scope(), 64, STR_TERMINATE);
 }
 
@@ -980 +997 @@
                 if (len) {
                         /* Length check. */
-                        int extra = put_nmb_name(NULL,offset,
+                        int extra = put_nmb_name(NULL,0,offset,
                                         &nmb->question.question_name);
                         if (offset + extra > len) {
@@ -986 +1003 @@
                         }
                 }
-                offset += put_nmb_name((char *)ubuf,offset,
+                offset += put_nmb_name((char *)ubuf,len,offset,
                                 &nmb->question.question_name);
                 if (buf) {
@@ -998 +1015 @@
                 if (len) {
                         /* Length check. */
-                        int extra = put_res_rec(NULL,offset,nmb->answers,
+                        int extra = put_res_rec(NULL,0,offset,nmb->answers,
                                         nmb->header.ancount);
                         if (offset + extra > len) {
@@ -1004 +1021 @@
                         }
                 }
-                offset += put_res_rec((char *)ubuf,offset,nmb->answers,
+                offset += put_res_rec((char *)ubuf,len,offset,nmb->answers,
                                 nmb->header.ancount);
         }
@@ -1011 +1028 @@
                 if (len) {
                         /* Length check. */
-                        int extra = put_res_rec(NULL,offset,nmb->nsrecs,
+                        int extra = put_res_rec(NULL,0,offset,nmb->nsrecs,
                                 nmb->header.nscount);
                         if (offset + extra > len) {
@@ -1017 +1034 @@
                         }
                 }
-                offset += put_res_rec((char *)ubuf,offset,nmb->nsrecs,
+                offset += put_res_rec((char *)ubuf,len,offset,nmb->nsrecs,
                                 nmb->header.nscount);
         }
@@ -1049 +1066 @@
                 if (len) {
                         /* Length check. */
-                        int extra = put_res_rec(NULL,offset,nmb->additional,
+                        int extra = put_res_rec(NULL,0,offset,nmb->additional,
                                 nmb->header.arcount);
                         if (offset + extra > len) {
@@ -1055 +1072 @@
                         }
                 }
-                offset += put_res_rec((char *)ubuf,offset,nmb->additional,
+                offset += put_res_rec((char *)ubuf,len,offset,nmb->additional,
                         nmb->header.arcount);
         }
@@ -1132 +1149 @@
 ***************************************************************************/
 
-int matching_len_bits(unsigned char *p1, unsigned char *p2, size_t len)
+int matching_len_bits(const unsigned char *p1, const unsigned char *p2, size_t len)
 {
         size_t i, j;
@@ -1246 +1263 @@
         char *p;
 
-        result = talloc_array(mem_ctx, char, 33 + strlen(global_scope()) + 2);
+        result = talloc_array(mem_ctx, char, 33 + strlen(lp_netbios_scope()) + 2);
         if (result == NULL) {
                 return NULL;
@@ -1262 +1279 @@
 
                 pull_ascii_fstring(buf_unix, In);
-                strupper_m(buf_unix);
+                if (!strupper_m(buf_unix)) {
+                        return NULL;
+                }
 
                 push_ascii_nstring(buf_dos, buf_unix);
@@ -1281 +1300 @@
 
         /* Add the scope string. */
-        for( i = 0, len = 0; *(global_scope()) != '\0'; i++, len++ ) {
-                switch( (global_scope())[i] ) {
+        for( i = 0, len = 0; *(lp_netbios_scope()) != '\0'; i++, len++ ) {
+                switch( (lp_netbios_scope())[i] ) {
                         case '\0':
                                 p[0] = len;
@@ -1294 +1313 @@
                                 break;
                         default:
-                                p[len+1] = (global_scope())[i];
+                                p[len+1] = (lp_netbios_scope())[i];
                                 break;
                 }
@@ -1316 +1335 @@
         c = *(unsigned char *)(buf+ofs);
         if ((c & 0xC0) == 0xC0) {
-                uint16 l = 0;
+                uint16_t l = 0;
 
                 if (ofs > buf_len - 1) {