We never checked if the smb packet len is != 0

Should fix a supposed DoS too.
(This used to be commit f76e5b2677beb161c2f9c0d3dd78e707655e942f)

diff --git a/source3/lib/util_sock.c b/source3/lib/util_sock.c
index 56ef4a6ab1cd028d0b97e5b9587681fd2c641772..03c780f8bfcded31c50c3bc51d79f029d4c1186b 100644 (file)
--- a/source3/lib/util_sock.c
+++ b/source3/lib/util_sock.c
@@ -585,8 +585,8 @@ BOOL receive_smb(int fd,char *buffer, unsigned int timeout)
        memset(buffer,'\0',smb_size + 100);
 
        len = read_smb_length_return_keepalive(fd,buffer,timeout);
-       if (len < 0) {
-               DEBUG(10,("receive_smb: length < 0!\n"));
+       if (len < 0 || len == 0) {
+               DEBUG(10,("receive_smb: length < 0 or == 0!\n"));
 
                /*
                 * Correct fix. smb_read_error may have already been