git.samba.org
/
samba.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(from parent 1:
fc6616e
)
Fix bug 7063 - Samba 3.4.5 on ubuntu 8.04 64 bit - Core dumps.
author
Jeremy Allison
<jra@samba.org>
Wed, 3 Feb 2010 00:38:40 +0000
(16:38 -0800)
committer
Karolin Seeger
<kseeger@samba.org>
Mon, 15 Feb 2010 13:46:51 +0000
(14:46 +0100)
Reported and found by Martin Hochreiter <linuxbox@wavenet.at>.
Ensure we copy the right amount of registry data into the outgoing
buffer.
Jeremy.
(cherry picked from commit
4dd841cf3f71b33a18db70bbbb968a647aaa8efc
)
source3/rpc_server/srv_spoolss_nt.c
patch
|
blob
|
history
diff --git
a/source3/rpc_server/srv_spoolss_nt.c
b/source3/rpc_server/srv_spoolss_nt.c
index e88c73304be9bebb262133474182aae8f099eec5..c490a38a42fd9fc32f01869af8a266193ff95efe 100644
(file)
--- a/
source3/rpc_server/srv_spoolss_nt.c
+++ b/
source3/rpc_server/srv_spoolss_nt.c
@@
-8073,8
+8073,15
@@
WERROR _spoolss_EnumPrinterData(pipes_struct *p,
/* data - counted in bytes */
- if (r->out.data && regval_size(val)) {
- memcpy(r->out.data, regval_data_p(val), regval_size(val));
+ /*
+ * See the section "Dynamically Typed Query Parameters"
+ * in MS-RPRN.
+ */
+
+ if (r->out.data && regval_data_p(val) &&
+ regval_size(val) && r->in.data_offered) {
+ memcpy(r->out.data, regval_data_p(val),
+ MIN(regval_size(val),r->in.data_offered));
}
*r->out.data_needed = regval_size(val);