r23728: First part of bugfix for #4763. Limit notify responses

to client max buf size.
Jeremy.
(This used to be commit 6113f56919a3cd7fd753808dbbe473603851bc3c)

diff --git a/source3/smbd/notify.c b/source3/smbd/notify.c
index 1b759169423554c231ba9ef7c99445ca52d64b91..746a8f47e5c7ded825175bc56e4a97cc6d2aadfb 100644 (file)
--- a/source3/smbd/notify.c
+++ b/source3/smbd/notify.c
@@ -22,6 +22,9 @@
 
 #include "includes.h"
 
+/* Max size we can send to client in a notify response. */
+extern int max_send;
+
 struct notify_change_request {
        struct notify_change_request *prev, *next;
        struct files_struct *fsp;       /* backpointer for cancel by mid */
@@ -147,6 +150,15 @@ void change_notify_reply(const char *request_buf,
 
        buflen = smb_size+38+prs_offset(&ps) + 4 /* padding */;
 
+       if (buflen > max_send) {
+               /*
+                * We exceed what the client is willing to accept. Send
+                * nothing.
+                */
+               change_notify_reply_packet(request_buf, NT_STATUS_OK);
+               goto done;
+       }
+
        if (!(outbuf = SMB_MALLOC_ARRAY(char, buflen))) {
                change_notify_reply_packet(request_buf, NT_STATUS_NO_MEMORY);
                goto done;