Remove a direct inbuf reference in reply_negprot

diff --git a/source3/smbd/negprot.c b/source3/smbd/negprot.c
index fe168aad3ac0e7fe7c72a0de9972a47565deb122..43fdc1d60861403bfa0046871457e2180d88dda0 100644 (file)
--- a/source3/smbd/negprot.c
+++ b/source3/smbd/negprot.c
@@ -507,7 +507,6 @@ static const struct {
 
 void reply_negprot(struct smb_request *req)
 {
-       size_t size = smb_len(req->inbuf) + 4;
        int choice= -1;
        int protocol;
        const char *p;
@@ -527,7 +526,14 @@ void reply_negprot(struct smb_request *req)
        }
        done_negprot = True;
 
-       if (req->inbuf[size-1] != '\0') {
+       if (req->buflen == 0) {
+               DEBUG(0, ("negprot got no protocols\n"));
+               reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+               END_PROFILE(SMBnegprot);
+               return;
+       }
+
+       if (req->buf[req->buflen-1] != '\0') {
                DEBUG(0, ("negprot protocols not 0-terminated\n"));
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
                END_PROFILE(SMBnegprot);