From 36112a442fd851d79fef847bf75d570454116df8 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Tue, 26 Jul 2011 14:11:56 +1000 Subject: s3-smbd Ensure we do not read past the end of a possible NTLMSSP blob Signed-off-by: Andrew Tridgell --- source3/smbd/sesssetup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'source3/smbd/sesssetup.c') diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c index 683f6b2c15..54c469c25a 100644 --- a/source3/smbd/sesssetup.c +++ b/source3/smbd/sesssetup.c @@ -1154,7 +1154,7 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req) return; } - if (strncmp((char *)(blob1.data), "NTLMSSP", 7) == 0) { + if (blob1.length > 7 && strncmp((char *)(blob1.data), "NTLMSSP", 7) == 0) { DATA_BLOB chal; if (!vuser->auth_ntlmssp_state) { -- cgit