s3-libsmb: Fix parsing a notify response

diff --git a/source3/libsmb/clifile.c b/source3/libsmb/clifile.c
index 3adc61559dd44a6b69aac4f5a6dbf390c89394c5..a25eb4636e473c759bf69045897b307b40711214 100644 (file)
--- a/source3/libsmb/clifile.c
+++ b/source3/libsmb/clifile.c
@@ -5028,7 +5028,7 @@ static void cli_notify_done(struct tevent_req *subreq)
                ssize_t ret;
                char *name;
 
-               if ((next != 0) && (len+12 != next)) {
+               if (trans_oob(num_params, ofs + 12, len)) {
                        TALLOC_FREE(params);
                        tevent_req_nterror(
                                req, NT_STATUS_INVALID_NETWORK_RESPONSE);