diff options
| author | Stefan Metzmacher <metze@samba.org> | 2013-09-24 05:03:40 +0200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2013-12-09 07:05:45 +0100 |
| commit | 2fb570abec6d07cee61332cf518703060514d3a0 (patch) | |
| tree | 6691aa9b2d70d8a80be7640d23c2005dcfc65cab /librpc/rpc/dcerpc_util.c | |
| parent | c65ad56d40c2ac286dc9d726119d04384981d0b3 (diff) | |
| download | samba-2fb570abec6d07cee61332cf518703060514d3a0.tar.gz | |
CVE-2013-4408:librpc: check for invalid frag_len within dcerpc_read_ncacn_packet_done()
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Diffstat (limited to 'librpc/rpc/dcerpc_util.c')
| -rw-r--r-- | librpc/rpc/dcerpc_util.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/librpc/rpc/dcerpc_util.c b/librpc/rpc/dcerpc_util.c index 980b0709dba..c963da84ce3 100644 --- a/librpc/rpc/dcerpc_util.c +++ b/librpc/rpc/dcerpc_util.c @@ -292,6 +292,11 @@ static void dcerpc_read_ncacn_packet_done(struct tevent_req *subreq) return; } + if (state->pkt->frag_length != state->buffer.length) { + tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR); + return; + } + tevent_req_done(req); } |