diff options
| author | Jeremy Allison <jra@samba.org> | 2013-11-07 21:40:55 -0800 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2013-12-05 10:18:10 +0100 |
| commit | c406802cf767929c7016041da51fb512094a7f30 (patch) | |
| tree | 9d8a0358b9245eab38145503a55bd8b9857c847d /source4/libnet/userman.c | |
| parent | ca5d6f5eed28350a7d0a5179e2d4ca31d0069959 (diff) | |
| download | samba-c406802cf767929c7016041da51fb512094a7f30.tar.gz | |
CVE-2013-4408:s3:Ensure LookupNames replies arrays are range checked.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Jeremy Allison <jra@samba.org>
Diffstat (limited to 'source4/libnet/userman.c')
| -rw-r--r-- | source4/libnet/userman.c | 24 |
1 files changed, 10 insertions, 14 deletions
diff --git a/source4/libnet/userman.c b/source4/libnet/userman.c index c1ee0179902..a7301eab6c6 100644 --- a/source4/libnet/userman.c +++ b/source4/libnet/userman.c @@ -237,14 +237,12 @@ static void continue_userdel_name_found(struct tevent_req *subreq) /* what to do when there's no user account to delete and what if there's more than one rid resolved */ - if (!s->lookupname.out.rids->count) { - c->status = NT_STATUS_NO_SUCH_USER; - composite_error(c, c->status); + if (s->lookupname.out.rids->count != s->lookupname.in.num_names) { + composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE); return; - - } else if (!s->lookupname.out.rids->count > 1) { - c->status = NT_STATUS_INVALID_ACCOUNT_NAME; - composite_error(c, c->status); + } + if (s->lookupname.out.types->count != s->lookupname.in.num_names) { + composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE); return; } @@ -513,14 +511,12 @@ static void continue_usermod_name_found(struct tevent_req *subreq) /* what to do when there's no user account to delete and what if there's more than one rid resolved */ - if (!s->lookupname.out.rids->count) { - c->status = NT_STATUS_NO_SUCH_USER; - composite_error(c, c->status); + if (s->lookupname.out.rids->count != s->lookupname.in.num_names) { + composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE); return; - - } else if (!s->lookupname.out.rids->count > 1) { - c->status = NT_STATUS_INVALID_ACCOUNT_NAME; - composite_error(c, c->status); + } + if (s->lookupname.out.types->count != s->lookupname.in.num_names) { + composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE); return; } |