diff options
| author | Volker Lendecke <vl@samba.org> | 2020-05-02 14:59:07 +0200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2020-05-14 07:18:23 +0000 |
| commit | bfe436e4c8027959e64650369accf3a2f1170723 (patch) | |
| tree | 08acb02b0d078dbd3fbd189b10c10269a70df55b | |
| parent | 70d390656b6abe4d70979d0dd13e6b025a5261f0 (diff) | |
| download | samba-bfe436e4c8027959e64650369accf3a2f1170723.tar.gz | |
libsmb: Protect cli_RNetShareEnum() against rprcnt<6
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14366
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 4a9fe4efefa67d6f24efcbe29722a43fc4859fdc)
| -rw-r--r-- | source3/libsmb/clirap.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/source3/libsmb/clirap.c b/source3/libsmb/clirap.c index a703f453556..9b7f54c503b 100644 --- a/source3/libsmb/clirap.c +++ b/source3/libsmb/clirap.c @@ -204,6 +204,11 @@ int cli_RNetShareEnum(struct cli_state *cli, void (*fn)(const char *, uint32_t, goto done; } + if (rprcnt < 6) { + DBG_ERR("Got invalid result: rprcnt=%u\n", rprcnt); + goto done; + } + res = rparam? SVAL(rparam,0) : -1; if (res == 0 || res == ERRmoredata) { |