diff options
| author | Jeremy Allison <jra@samba.org> | 2013-11-07 22:41:22 -0800 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2013-12-09 09:00:41 +0100 |
| commit | f799f63e4312b25d3c671e7a4072607fdba0c768 (patch) | |
| tree | cf7bde894e1f9684328abfa05849108f822ab054 /source3/rpcclient/cmd_samr.c | |
| parent | 0dc618189469bf389a583eb346ddc6acaad1c644 (diff) | |
| download | samba-f799f63e4312b25d3c671e7a4072607fdba0c768.tar.gz | |
CVE-2013-4408:s3:Ensure LookupRids() replies arrays are range checked.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185
Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Mon Dec 9 09:00:41 CET 2013 on sn-devel-104
Diffstat (limited to 'source3/rpcclient/cmd_samr.c')
| -rw-r--r-- | source3/rpcclient/cmd_samr.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/source3/rpcclient/cmd_samr.c b/source3/rpcclient/cmd_samr.c index 5bc8c0b57b8..87882c3ce4e 100644 --- a/source3/rpcclient/cmd_samr.c +++ b/source3/rpcclient/cmd_samr.c @@ -2223,6 +2223,14 @@ static NTSTATUS cmd_samr_lookup_rids(struct rpc_pipe_client *cli, goto done; /* Display results */ + if (num_rids != names.count) { + status = NT_STATUS_INVALID_NETWORK_RESPONSE; + goto done; + } + if (num_rids != types.count) { + status = NT_STATUS_INVALID_NETWORK_RESPONSE; + goto done; + } for (i = 0; i < num_rids; i++) { printf("rid 0x%x: %s (%d)\n", |