Author: vlendec Date: 2006-03-29 10:20:28 +0000 (Wed, 29 Mar 2006) New Revision: 14754
WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=14754 Log: Many variables to shuffle around... Thanks to G?\195?\188nther Kukkukk for testing it! Volker Modified: trunk/source/smbd/ipc.c trunk/source/smbd/nttrans.c trunk/source/smbd/trans2.c Changeset: Modified: trunk/source/smbd/ipc.c =================================================================== --- trunk/source/smbd/ipc.c 2006-03-29 09:40:42 UTC (rev 14753) +++ trunk/source/smbd/ipc.c 2006-03-29 10:20:28 UTC (rev 14754) @@ -638,7 +638,7 @@ goto bad_param; if (pdisp > state->total_param) goto bad_param; - if ((smb_base(inbuf) + poff + pcnt >= inbuf+bufsize) || + if ((smb_base(inbuf) + poff + pcnt >= inbuf + size) || (smb_base(inbuf) + poff + pcnt < smb_base(inbuf))) goto bad_param; if (state->param + pdisp < state->param) @@ -655,7 +655,7 @@ goto bad_param; if (ddisp > state->total_data) goto bad_param; - if ((smb_base(inbuf) + doff + dcnt >= inbuf + bufsize) || + if ((smb_base(inbuf) + doff + dcnt >= inbuf + size) || (smb_base(inbuf) + doff + dcnt < smb_base(inbuf))) goto bad_param; if (state->data + ddisp < state->data) Modified: trunk/source/smbd/nttrans.c =================================================================== --- trunk/source/smbd/nttrans.c 2006-03-29 09:40:42 UTC (rev 14753) +++ trunk/source/smbd/nttrans.c 2006-03-29 10:20:28 UTC (rev 14754) @@ -3029,7 +3029,7 @@ goto bad_param; if (pdisp > state->total_param) goto bad_param; - if ((smb_base(inbuf) + poff + pcnt >= inbuf+bufsize) || + if ((smb_base(inbuf) + poff + pcnt >= inbuf + size) || (smb_base(inbuf) + poff + pcnt < smb_base(inbuf))) goto bad_param; if (state->param + pdisp < state->param) @@ -3046,7 +3046,7 @@ goto bad_param; if (ddisp > state->total_data) goto bad_param; - if ((smb_base(inbuf) + doff + dcnt >= inbuf + bufsize) || + if ((smb_base(inbuf) + doff + dcnt >= inbuf + size) || (smb_base(inbuf) + doff + dcnt < smb_base(inbuf))) goto bad_param; if (state->data + ddisp < state->data) Modified: trunk/source/smbd/trans2.c =================================================================== --- trunk/source/smbd/trans2.c 2006-03-29 09:40:42 UTC (rev 14753) +++ trunk/source/smbd/trans2.c 2006-03-29 10:20:28 UTC (rev 14754) @@ -5314,7 +5314,7 @@ goto bad_param; if (pdisp > state->total_param) goto bad_param; - if ((smb_base(inbuf) + poff + pcnt >= inbuf+bufsize) || + if ((smb_base(inbuf) + poff + pcnt >= inbuf + size) || (smb_base(inbuf) + poff + pcnt < smb_base(inbuf))) goto bad_param; if (state->param + pdisp < state->param) @@ -5331,7 +5331,7 @@ goto bad_param; if (ddisp > state->total_data) goto bad_param; - if ((smb_base(inbuf) + doff + dcnt >= inbuf + bufsize) || + if ((smb_base(inbuf) + doff + dcnt >= inbuf + size) || (smb_base(inbuf) + doff + dcnt < smb_base(inbuf))) goto bad_param; if (state->data + ddisp < state->data)
