diff options
| author | Gary Lockyer <gary@catalyst.net.nz> | 2019-05-24 11:00:05 +1200 |
|---|---|---|
| committer | Gary Lockyer <gary@samba.org> | 2019-05-27 01:29:48 +0000 |
| commit | 412afb2aef100e09eb433b8f0cae064fc2a736b7 (patch) | |
| tree | 2a3eedf4bbb4bc450d31652a7d765762237c4807 /source4/smb_server | |
| parent | da87fa998ab71328f30bcdf5b41aee8675aee48a (diff) | |
| download | samba-412afb2aef100e09eb433b8f0cae064fc2a736b7.tar.gz | |
Fix ubsan null pointer passed as argument 2
Fix ubsan warning null pointer passed as argument 2 when the source
pointer is NULL. The calls to memcpy are now guarded by an
if (len > 0)
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Gary Lockyer <gary@samba.org>
Autobuild-Date(master): Mon May 27 01:29:48 UTC 2019 on sn-devel-184
Diffstat (limited to 'source4/smb_server')
| -rw-r--r-- | source4/smb_server/smb/nttrans.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/source4/smb_server/smb/nttrans.c b/source4/smb_server/smb/nttrans.c index 97c4bb570d7..8e4d004f96c 100644 --- a/source4/smb_server/smb/nttrans.c +++ b/source4/smb_server/smb/nttrans.c @@ -570,8 +570,11 @@ static void reply_nttrans_send(struct ntvfs_request *ntvfs) SIVAL(this_req->out.vwv, 31, PTR_DIFF(data, trans->out.data.data)); SCVAL(this_req->out.vwv, 35, trans->out.setup_count); - memcpy((char *)(this_req->out.vwv) + VWV(18), trans->out.setup, - sizeof(uint16_t) * trans->out.setup_count); + if (trans->out.setup_count > 0) { + memcpy((char *)(this_req->out.vwv) + VWV(18), + trans->out.setup, + sizeof(uint16_t) * trans->out.setup_count); + } memset(this_req->out.data, 0, align1); if (this_param != 0) { memcpy(this_req->out.data + align1, params, this_param); |