Fix bug #10010 - Missing integer wrap protection in EA list reading can cause server...

[samba.git] / source3 / smbd / nttrans.c

diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c
index decb07cfb29de3844010d88f1ed8b0ed97381d62..25597696b0ba99455863e84fed717b7674917dde 100644 (file)
--- a/source3/smbd/nttrans.c
+++ b/source3/smbd/nttrans.c
@@ -133,11 +133,6 @@ void send_nt_replies(connection_struct *conn,
                             total_sent_thistime + alignment_offset
                             + data_alignment_offset);
 
-               /*
-                * We might have had SMBnttranss in req->inbuf, fix that.
-                */
-               SCVAL(req->outbuf, smb_com, SMBnttrans);
-
                /*
                 * Set total params and data to be sent.
                 */
@@ -939,7 +934,19 @@ struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t
                if (next_offset == 0) {
                        break;
                }
+
+               /* Integer wrap protection for the increment. */
+               if (offset + next_offset < offset) {
+                       break;
+               }
+
                offset += next_offset;
+
+               /* Integer wrap protection for while loop. */
+               if (offset + 4 < offset) {
+                       break;
+               }
+
        }
 
        return ea_list_head;
@@ -1883,9 +1890,11 @@ static void call_nt_transact_query_security_desc(connection_struct *conn,
                psd->group_sid = NULL;
        }
        if (!(security_info_wanted & SECINFO_DACL)) {
+               psd->type &= ~SEC_DESC_DACL_PRESENT;
                psd->dacl = NULL;
        }
        if (!(security_info_wanted & SECINFO_SACL)) {
+               psd->type &= ~SEC_DESC_SACL_PRESENT;
                psd->sacl = NULL;
        }
 
@@ -3066,6 +3075,12 @@ void reply_nttranss(struct smb_request *req)
 
        show_msg((char *)req->inbuf);
 
+       /* Windows clients expect all replies to
+          an NT transact secondary (SMBnttranss 0xA1)
+          to have a command code of NT transact
+          (SMBnttrans 0xA0). See bug #8989 for details. */
+       req->cmd = SMBnttrans;
+
        if (req->wct < 18) {
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
                END_PROFILE(SMBnttranss);