From: Andrew Tridgell <tridge@samba.org>
Date: Thu, 25 Sep 2008 00:33:15 +0000 (-0700)
Subject: check for a 0 byte in the buffer in SMB2 read
X-Git-Tag: samba-4.0.0alpha6~769^2~228^2~171
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a3536c4c06d9725b2e96b9a3ddc1ab14e47f472c;p=thirdparty%2Fsamba.git

check for a 0 byte in the buffer in SMB2 read
---

diff --git a/source4/smb_server/smb2/fileio.c b/source4/smb_server/smb2/fileio.c
index 2c322ea5876..4f4402ba330 100644
--- a/source4/smb_server/smb2/fileio.c
+++ b/source4/smb_server/smb2/fileio.c
@@ -254,6 +254,12 @@ void smb2srv_read_recv(struct smb2srv_request *req)
 	union smb_read *io;
 
 	SMB2SRV_CHECK_BODY_SIZE(req, 0x30, true);
+
+	/* MS-SMB2 2.2.19 read must have a single byte of zero */
+	if (req->in.body_size - req->in.body_fixed < 1) {
+		smb2srv_send_error(req,  NT_STATUS_INVALID_PARAMETER);
+		return;
+	}
 	SMB2SRV_TALLOC_IO_PTR(io, union smb_read);
 	SMB2SRV_SETUP_NTVFS_REQUEST(smb2srv_read_send, NTVFS_ASYNC_STATE_MAY_ASYNC);