From: Volker Lendecke <vl@samba.org>
Date: Sat, 8 Nov 2008 16:14:06 +0000 (+0100)
Subject: Fix the offset checks in the trans routines
X-Git-Tag: samba-4.0.0alpha6~480^2~105
X-Git-Url: http://git.samba.org/?a=commitdiff_plain;h=114f519233cd37bfd623db820e888469c75fab26;p=samba.git

Fix the offset checks in the trans routines

This fixes a potential crash bug, a client can make us read memory we
should not read. Luckily I got the disp checks right...

Volker
(cherry picked from commit 64a1d80851da5b05e70ec6c96f6e9bd473748369)
(cherry picked from commit f04c5650a3aeca23591ddc781c4b297caaf9bb3f)
---

diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c
index 26a4212ec91..a617756a538 100644
--- a/source3/smbd/ipc.c
+++ b/source3/smbd/ipc.c
@@ -769,10 +769,10 @@ void reply_transs(struct smb_request *req)
 			goto bad_param;
 		}
 
-		if (ddisp > av_size ||
+		if (doff > av_size ||
 				dcnt > av_size ||
-				ddisp+dcnt > av_size ||
-				ddisp+dcnt < ddisp) {
+				doff+dcnt > av_size ||
+				doff+dcnt < doff) {
 			goto bad_param;
 		}
 
diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c
index 8a18c879037..329ba23ddd0 100644
--- a/source3/smbd/nttrans.c
+++ b/source3/smbd/nttrans.c
@@ -2818,10 +2818,10 @@ void reply_nttranss(struct smb_request *req)
 			goto bad_param;
 		}
 
-		if (ddisp > av_size ||
+		if (doff > av_size ||
 				dcnt > av_size ||
-				ddisp+dcnt > av_size ||
-				ddisp+dcnt < ddisp) {
+				doff+dcnt > av_size ||
+				doff+dcnt < doff) {
 			goto bad_param;
 		}
 
diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
index c385c6ccb17..0c63588ccc2 100644
--- a/source3/smbd/trans2.c
+++ b/source3/smbd/trans2.c
@@ -7811,10 +7811,10 @@ void reply_transs2(struct smb_request *req)
 			goto bad_param;
 		}
 
-		if (ddisp > av_size ||
+		if (doff > av_size ||
 				dcnt > av_size ||
-				ddisp+dcnt > av_size ||
-				ddisp+dcnt < ddisp) {
+				doff+dcnt > av_size ||
+				doff+dcnt < doff) {
 			goto bad_param;
 		}