From: Stefan Metzmacher <metze@samba.org>
Date: Tue, 6 Sep 2011 12:01:43 +0000 (+0200)
Subject: s3:smb2_server: use smbd_smb2_request_verify_sizes() in smb2_read.c
X-Git-Tag: samba-4.0.0alpha17~144
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f3a8d65bdfe496f080a74eb7104500bd8e2b0179;p=thirdparty%2Fsamba.git

s3:smb2_server: use smbd_smb2_request_verify_sizes() in smb2_read.c

metze
---

diff --git a/source3/smbd/smb2_read.c b/source3/smbd/smb2_read.c
index 8c3a8fd8777..99f6e7a91f3 100644
--- a/source3/smbd/smb2_read.c
+++ b/source3/smbd/smb2_read.c
@@ -44,11 +44,10 @@ static NTSTATUS smbd_smb2_read_recv(struct tevent_req *req,
 static void smbd_smb2_request_read_done(struct tevent_req *subreq);
 NTSTATUS smbd_smb2_request_process_read(struct smbd_smb2_request *req)
 {
+	NTSTATUS status;
 	const uint8_t *inhdr;
 	const uint8_t *inbody;
 	int i = req->current_idx;
-	size_t expected_body_size = 0x31;
-	size_t body_size;
 	uint32_t in_smbpid;
 	uint32_t in_length;
 	uint64_t in_offset;
@@ -58,18 +57,13 @@ NTSTATUS smbd_smb2_request_process_read(struct smbd_smb2_request *req)
 	uint32_t in_remaining_bytes;
 	struct tevent_req *subreq;
 
-	inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
-	if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
-		return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+	status = smbd_smb2_request_verify_sizes(req, 0x31);
+	if (!NT_STATUS_IS_OK(status)) {
+		return smbd_smb2_request_error(req, status);
 	}
-
+	inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
 	inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
 
-	body_size = SVAL(inbody, 0x00);
-	if (body_size != expected_body_size) {
-		return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-	}
-
 	in_smbpid = IVAL(inhdr, SMB2_HDR_PID);
 
 	in_length		= IVAL(inbody, 0x04);