diff options
| author | Stefan Metzmacher <metze@samba.org> | 2013-09-25 23:25:12 +0200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2013-12-09 07:05:45 +0100 |
| commit | ecdac51e85ccc3503b9f732838475bf97092c6ba (patch) | |
| tree | f5b4b2c47d6fcf4ba1c874dee25e38bc54636cb1 /source3/librpc | |
| parent | dfd4fc1591f17998bf7b6a867900ed6f1b35ca7c (diff) | |
| download | samba-ecdac51e85ccc3503b9f732838475bf97092c6ba.tar.gz samba-ecdac51e85ccc3503b9f732838475bf97092c6ba.tar.xz samba-ecdac51e85ccc3503b9f732838475bf97092c6ba.zip | |
CVE-2013-4408:s3:rpc_client: check for invalid frag_len in dcerpc_pull_ncacn_packet()
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Diffstat (limited to 'source3/librpc')
| -rw-r--r-- | source3/librpc/rpc/dcerpc_helpers.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/source3/librpc/rpc/dcerpc_helpers.c b/source3/librpc/rpc/dcerpc_helpers.c index 28222f4820e..2400bfd5669 100644 --- a/source3/librpc/rpc/dcerpc_helpers.c +++ b/source3/librpc/rpc/dcerpc_helpers.c @@ -124,6 +124,10 @@ NTSTATUS dcerpc_pull_ncacn_packet(TALLOC_CTX *mem_ctx, NDR_PRINT_DEBUG(ncacn_packet, r); } + if (r->frag_length != blob->length) { + return NT_STATUS_RPC_PROTOCOL_ERROR; + } + return NT_STATUS_OK; } |