r23752: Fix bug introduced by checkin 22920, allow large

readX. Fix from Dmitry Shatrov <dhsatrov@linux.vnet.ibm.com>.

"In send_file_readX(), if startpos > sbuf.st_size, then smb_maxcnt is set
to an invalid large value due to integer overflow.
As for me, this resulted in MS Word hanging while trying to save
a 1.5Mb document."

This isn't in shipping code.

Jeremy.
(This used to be commit af715c602a8ef6038e6272c7cc6a08501617ae67)

diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 6e41de4ec9af9ba4dc45b8ff3c990d0d6d1ea92f..b17fa1949bce5aeb6f626a08f4c14dafcae2d685 100644 (file)
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -2590,9 +2590,7 @@ int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length
 
        if (startpos > sbuf.st_size) {
                smb_maxcnt = 0;
-       }
-
-       if (smb_maxcnt > (sbuf.st_size - startpos)) {
+       } else if (smb_maxcnt > (sbuf.st_size - startpos)) {
                smb_maxcnt = (sbuf.st_size - startpos);
        }