Skip to content

Commit 96480ab

Browse files
committed
(for 4.9.3) SMB: Add two missing bounds checks
1 parent 689c6e6 commit 96480ab

File tree

1 file changed

+8
-3
lines changed

1 file changed

+8
-3
lines changed

Diff for: print-smb.c

+8-3
Original file line numberDiff line numberDiff line change
@@ -371,16 +371,21 @@ print_trans(netdissect_options *ndo,
371371
ND_PRINT((ndo, "smb_bcc=%u\n", bcc));
372372
if (bcc > 0) {
373373
smb_fdata(ndo, data1 + 2, f2, maxbuf - (paramlen + datalen), unicodestr);
374-
375-
if (strcmp((const char *)(data1 + 2), "\\MAILSLOT\\BROWSE") == 0) {
374+
#define MAILSLOT_BROWSE_STR "\\MAILSLOT\\BROWSE"
375+
ND_TCHECK2(*(data1 + 2), strlen(MAILSLOT_BROWSE_STR) + 1);
376+
if (strcmp((const char *)(data1 + 2), MAILSLOT_BROWSE_STR) == 0) {
376377
print_browse(ndo, param, paramlen, data, datalen);
377378
return;
378379
}
380+
#undef MAILSLOT_BROWSE_STR
379381

380-
if (strcmp((const char *)(data1 + 2), "\\PIPE\\LANMAN") == 0) {
382+
#define PIPE_LANMAN_STR "\\PIPE\\LANMAN"
383+
ND_TCHECK2(*(data1 + 2), strlen(PIPE_LANMAN_STR) + 1);
384+
if (strcmp((const char *)(data1 + 2), PIPE_LANMAN_STR) == 0) {
381385
print_ipc(ndo, param, paramlen, data, datalen);
382386
return;
383387
}
388+
#undef PIPE_LANMAN_STR
384389

385390
if (paramlen)
386391
smb_fdata(ndo, param, f3, min(param + paramlen, maxbuf), unicodestr);

0 commit comments

Comments
 (0)