s3: Protect against an invalid bcc in SMBsendtxt

[ira/wip.git] / source3 / smbd / message.c

diff --git a/source3/smbd/message.c b/source3/smbd/message.c
index 82b3dc30a223eb2c7ebe9bd02ce81b6a4cc57e84..386aca1727cd9932f82d879b68d444f100c5bc37 100644 (file)
--- a/source3/smbd/message.c
+++ b/source3/smbd/message.c
@@ -245,7 +245,7 @@ void reply_sendtxt(struct smb_request *req)
                return;
        }
 
-       if (smbd_msg_state == NULL) {
+       if ((smbd_msg_state == NULL) || (req->buflen < 3)) {
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
                END_PROFILE(SMBsendtxt);
                return;