s3:smbd: Out-by-4 error in smbd read reply max_send clamp

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14443

Signed-off-by: Robert Sprowson <webpages@sprow.co.uk>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <noel.power@suse.com>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Jun  8 19:50:08 UTC 2022 on sn-devel-184

diff --git a/source3/smbd/smb1_reply.c b/source3/smbd/smb1_reply.c
index 140d03242c36b118f6b1e4f93442d40a44e410a7..6dfc636c9d81e8e94cc0d1bedfb97540d0322f5e 100644 (file)
--- a/source3/smbd/smb1_reply.c
+++ b/source3/smbd/smb1_reply.c
@@ -2844,7 +2844,7 @@ static void reply_lockread_locked(struct tevent_req *subreq)
        /*
         * However the requested READ size IS affected by max_send. Insanity.... JRA.
         */
-       maxtoread = req->xconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
+       maxtoread = req->xconn->smb1.sessions.max_send - (MIN_SMB_SIZE + 5*2 + 3);
 
        if (numtoread > maxtoread) {
                DBG_WARNING("requested read size (%zu) is greater than "
@@ -2940,7 +2940,7 @@ void reply_read(struct smb_request *req)
        /*
         * The requested read size cannot be greater than max_send. JRA.
         */
-       maxtoread = xconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
+       maxtoread = xconn->smb1.sessions.max_send - (MIN_SMB_SIZE + 5*2 + 3);
 
        if (numtoread > maxtoread) {
                DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u/%u). \