From: Stefan Metzmacher Date: Thu, 29 Jan 2015 09:12:30 +0000 (+0100) Subject: s3:smb2_server: protect against integer wrap with "smb2 max credits = 65535" X-Git-Tag: samba-4.0.26~59 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9f56abbc4d8a9acc540c94d964d4b9e408208da5;p=thirdparty%2Fsamba.git s3:smb2_server: protect against integer wrap with "smb2 max credits = 65535" Bug: https://bugzilla.samba.org/show_bug.cgi?id=9702 Signed-off-by: Stefan Metzmacher Reviewed-by: Ralph Boehme Autobuild-User(master): Stefan Metzmacher Autobuild-Date(master): Thu Jan 29 14:58:40 CET 2015 on sn-devel-104 (similar to commit 8aed0fc38ae28cce7fd1a443844a865265fc719c) Autobuild-User(v4-0-test): Karolin Seeger Autobuild-Date(v4-0-test): Thu Feb 5 23:44:30 CET 2015 on sn-devel-104 --- diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c index 5d2aeb1a206..98c6e58d232 100644 --- a/source3/smbd/smb2_server.c +++ b/source3/smbd/smb2_server.c @@ -797,6 +797,8 @@ static void smb2_set_operation_credit(struct smbd_server_connection *sconn, */ credits_granted = 0; } else { + uint16_t additional_possible = + sconn->smb2.max_credits - credit_charge; uint16_t additional_max = 0; uint16_t additional_credits = credits_requested - 1; @@ -822,6 +824,7 @@ static void smb2_set_operation_credit(struct smbd_server_connection *sconn, break; } + additional_max = MIN(additional_max, additional_possible); additional_credits = MIN(additional_credits, additional_max); credits_granted = credit_charge + additional_credits;