From f799f63e4312b25d3c671e7a4072607fdba0c768 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Thu, 7 Nov 2013 22:41:22 -0800 Subject: CVE-2013-4408:s3:Ensure LookupRids() replies arrays are range checked. Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185 Signed-off-by: Jeremy Allison Signed-off-by: Stefan Metzmacher Autobuild-User(master): Karolin Seeger Autobuild-Date(master): Mon Dec 9 09:00:41 CET 2013 on sn-devel-104 --- source3/lib/netapi/user.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'source3/lib/netapi/user.c') diff --git a/source3/lib/netapi/user.c b/source3/lib/netapi/user.c index 72d4a8bdc3..4a39f6976d 100644 --- a/source3/lib/netapi/user.c +++ b/source3/lib/netapi/user.c @@ -3114,6 +3114,14 @@ WERROR NetUserGetGroups_r(struct libnetapi_ctx *ctx, werr = ntstatus_to_werror(result); goto done; } + if (names.count != rid_array->count) { + werr = WERR_BAD_NET_RESP; + goto done; + } + if (types.count != rid_array->count) { + werr = WERR_BAD_NET_RESP; + goto done; + } for (i=0; i < names.count; i++) { status = add_GROUP_USERS_INFO_X_buffer(ctx, @@ -3716,6 +3724,14 @@ WERROR NetUserGetLocalGroups_r(struct libnetapi_ctx *ctx, werr = ntstatus_to_werror(result); goto done; } + if (names.count != num_rids) { + werr = WERR_BAD_NET_RESP; + goto done; + } + if (types.count != num_rids) { + werr = WERR_BAD_NET_RESP; + goto done; + } for (i=0; i < names.count; i++) { status = add_LOCALGROUP_USERS_INFO_X_buffer(ctx, -- cgit