From a6eee38ba2f89280676f0a32d26745afd95b551c Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Mon, 11 May 2020 18:18:24 +0200 Subject: [PATCH] smb2_server: fix smbd_smb2_request_verify_sizes() for SMB2_OP_WRITE Writes with a length of 0 are allowed. The readfile related check we had before was not really useful as min_dyn_len can only every be 0 or 1 (and for SMB2_OP_WRITE it's always 1). So we checked if (unread_bytes > 0) { if (unread_bytes < 1) { return error; } } BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 Signed-off-by: Stefan Metzmacher Reviewed-by: Jeremy Allison --- source3/smbd/smb2_server.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c index a4372bf1145..718f0941532 100644 --- a/source3/smbd/smb2_server.c +++ b/source3/smbd/smb2_server.c @@ -2073,16 +2073,8 @@ NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req, switch (opcode) { case SMB2_OP_IOCTL: case SMB2_OP_GETINFO: - min_dyn_size = 0; - break; case SMB2_OP_WRITE: - if (req->smb1req != NULL && req->smb1req->unread_bytes > 0) { - if (req->smb1req->unread_bytes < min_dyn_size) { - return NT_STATUS_INVALID_PARAMETER; - } - - min_dyn_size = 0; - } + min_dyn_size = 0; break; } -- 2.47.3