From: Steve Holme <steve_holme@hotmail.com>
Date: Sat, 6 Dec 2014 21:44:00 +0000 (+0000)
Subject: smb: Fixed a problem with large file transfers
X-Git-Tag: curl-7_40_0~204
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=befe9a10b976bba109d4dbde6dc1deb2cd0a79bc;p=thirdparty%2Fcurl.git

smb: Fixed a problem with large file transfers

Fixed an issue with the message size calculation where the raw bytes
from the buffer were interpreted as signed values rather than unsigned
values.

Reported-by: Gisle Vanem
Assisted-by: Bill Nagel
---

diff --git a/lib/smb.c b/lib/smb.c
index fa9e43fcac..1644471dfd 100644
--- a/lib/smb.c
+++ b/lib/smb.c
@@ -266,11 +266,11 @@ static CURLcode smb_recv_message(struct connectdata *conn, void **msg)
   msg_size = sizeof(struct smb_header);
   if(nbt_size >= msg_size + 1) {
     /* Add the word count */
-    msg_size += 1 + buf[msg_size] * sizeof(unsigned short);
+    msg_size += 1 + ((unsigned char) buf[msg_size]) * sizeof(unsigned short);
     if(nbt_size >= msg_size + sizeof(unsigned short)) {
       /* Add the byte count */
-      msg_size += sizeof(unsigned short) + buf[msg_size] +
-                  (buf[msg_size + 1] << 8);
+      msg_size += sizeof(unsigned short) + ((unsigned char) buf[msg_size]) +
+                  (((unsigned char) buf[msg_size + 1]) << 8);
       if(nbt_size < msg_size)
         return CURLE_READ_ERROR;
     }