From beb33855e0a349d9dcbed12b14420ab4efb499e0 Mon Sep 17 00:00:00 2001 From: Olga Kornievskaia Date: Thu, 26 Apr 2012 11:50:07 -0400 Subject: [PATCH] check pathlen on referrals --- daemon/lookup.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/daemon/lookup.c b/daemon/lookup.c index 9f43795..e1e685a 100644 --- a/daemon/lookup.c +++ b/daemon/lookup.c @@ -404,12 +404,16 @@ static int referral_resolve( } /* format a new path from that location's root */ - StringCchCopyA(rest_of_path, NFS41_MAX_PATH_LEN, - referral->name.name + referral->name.len); + if (FAILED(StringCchCopyA(rest_of_path, NFS41_MAX_PATH_LEN, + referral->name.name + referral->name.len))) { + status = ERROR_FILENAME_EXCED_RANGE; + goto out; + } AcquireSRWLockExclusive(&path_out->lock); abs_path_copy(path_out, &location->path); - StringCchCatA(path_out->path, NFS41_MAX_PATH_LEN, rest_of_path); + if (FAILED(StringCchCatA(path_out->path, NFS41_MAX_PATH_LEN, rest_of_path))) + status = ERROR_FILENAME_EXCED_RANGE; path_out->len = path_out->len + (unsigned short)strlen(rest_of_path); ReleaseSRWLockExclusive(&path_out->lock);