summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndrew Tridgell <tridge@samba.org>2010-02-17 10:23:14 +1100
committerAndrew Tridgell <tridge@samba.org>2010-02-17 10:54:05 +1100
commiteb8800e6118c2f77cef5a27f1c1b6118dd52d4ca (patch)
tree8f0393241637418977a965ce10e4abac0dc4f1da
parent77fc30b4811d78f79b8af2fef70eba7b9fa03e79 (diff)
downloadsamba-eb8800e6118c2f77cef5a27f1c1b6118dd52d4ca.tar.gz
samba-eb8800e6118c2f77cef5a27f1c1b6118dd52d4ca.tar.bz2
samba-eb8800e6118c2f77cef5a27f1c1b6118dd52d4ca.zip
s4-rpc: paranoid check for auth_length
This is not strictly needed as the ndr_pull_advance() checks it a few lines further down, but I want to save Jeremy getting more grey hairs :-)
-rw-r--r--source4/librpc/rpc/dcerpc_util.c11
1 files changed, 11 insertions, 0 deletions
diff --git a/source4/librpc/rpc/dcerpc_util.c b/source4/librpc/rpc/dcerpc_util.c
index aafa283fc6..9dabb54ca5 100644
--- a/source4/librpc/rpc/dcerpc_util.c
+++ b/source4/librpc/rpc/dcerpc_util.c
@@ -781,6 +781,17 @@ NTSTATUS dcerpc_pull_auth_trailer(struct ncacn_packet *pkt,
uint32_t pad;
pad = pkt_auth_blob->length - (DCERPC_AUTH_TRAILER_LENGTH + pkt->auth_length);
+
+ /* paranoia check for pad size. This would be caught anyway by
+ the ndr_pull_advance() a few lines down, but it scared
+ Jeremy enough for him to call me, so we might as well check
+ it now, just to prevent someone posting a bogus YouTube
+ video in the future.
+ */
+ if (pad > pkt_auth_blob->length) {
+ return NT_STATUS_INFO_LENGTH_MISMATCH;
+ }
+
*auth_length = pkt_auth_blob->length - pad;
ndr = ndr_pull_init_blob(pkt_auth_blob, mem_ctx, NULL);