diff options
| author | Stefan Metzmacher <metze@samba.org> | 2013-09-25 23:25:12 +0200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2013-12-05 11:11:51 +0100 |
| commit | 4487b19619fa0fbfc64c33cd073e67ceae8563c3 (patch) | |
| tree | ccbbe5a734fadbbfcbc8f5ccf700f77425121b0a | |
| parent | b13b1426f6c309b6ff3b2b5f9e335a62fd256969 (diff) | |
| download | samba-4487b19619fa0fbfc64c33cd073e67ceae8563c3.tar.gz | |
CVE-2013-4408:s3:rpc_client: check for invalid frag_len in dcerpc_pull_ncacn_packet()
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
| -rw-r--r-- | source3/librpc/rpc/dcerpc_helpers.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/source3/librpc/rpc/dcerpc_helpers.c b/source3/librpc/rpc/dcerpc_helpers.c index 469e3086c77..24f2f52f792 100644 --- a/source3/librpc/rpc/dcerpc_helpers.c +++ b/source3/librpc/rpc/dcerpc_helpers.c @@ -129,6 +129,10 @@ NTSTATUS dcerpc_pull_ncacn_packet(TALLOC_CTX *mem_ctx, NDR_PRINT_DEBUG(ncacn_packet, r); } + if (r->frag_length != blob->length) { + return NT_STATUS_RPC_PROTOCOL_ERROR; + } + return NT_STATUS_OK; } |