diff options
| author | Stefan Metzmacher <metze@samba.org> | 2013-09-25 23:25:12 +0200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2013-12-09 07:05:45 +0100 |
| commit | 8b7c862babeb2bccfe5041495706f2aac6f73f6f (patch) | |
| tree | d719b35e5adaa090ebe4d1f3a7bded3f6dd1b830 /source3/rpc_client | |
| parent | ecdac51e85ccc3503b9f732838475bf97092c6ba (diff) | |
| download | samba-8b7c862babeb2bccfe5041495706f2aac6f73f6f.tar.gz | |
CVE-2013-4408:s3:rpc_client: verify frag_len at least contains the header size
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Diffstat (limited to 'source3/rpc_client')
| -rw-r--r-- | source3/rpc_client/cli_pipe.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/source3/rpc_client/cli_pipe.c b/source3/rpc_client/cli_pipe.c index 13423540ecf..0769d6dbe6b 100644 --- a/source3/rpc_client/cli_pipe.c +++ b/source3/rpc_client/cli_pipe.c @@ -281,6 +281,10 @@ static struct tevent_req *get_complete_frag_send(TALLOC_CTX *mem_ctx, } state->frag_len = dcerpc_get_frag_length(pdu); + if (state->frag_len < RPC_HEADER_LEN) { + tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR); + return tevent_req_post(req, ev); + } /* * Ensure we have frag_len bytes of data. @@ -329,6 +333,10 @@ static void get_complete_frag_got_header(struct tevent_req *subreq) } state->frag_len = dcerpc_get_frag_length(state->pdu); + if (state->frag_len < RPC_HEADER_LEN) { + tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR); + return; + } if (!data_blob_realloc(NULL, state->pdu, state->frag_len)) { tevent_req_nterror(req, NT_STATUS_NO_MEMORY); |