diff options
| author | Stefan Metzmacher <metze@samba.org> | 2013-10-16 14:17:49 +0200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2013-12-05 10:18:09 +0100 |
| commit | bdb643e9cbd4df6c8d6868015d61441cb67dcd66 (patch) | |
| tree | c18a756690d4be98ae2a7b5836651074d6d915d5 | |
| parent | c4e31eac2bc28c40d51dab732c8c85ab92628ca6 (diff) | |
| download | samba-bdb643e9cbd4df6c8d6868015d61441cb67dcd66.tar.gz | |
CVE-2013-4408:libcli/util: add some size verification to tstream_read_pdu_blob_done()
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
| -rw-r--r-- | libcli/util/tstream.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libcli/util/tstream.c b/libcli/util/tstream.c index 12cef9b6dd..dd830e2aa4 100644 --- a/libcli/util/tstream.c +++ b/libcli/util/tstream.c @@ -129,6 +129,11 @@ static void tstream_read_pdu_blob_done(struct tevent_req *subreq) return; } + if (new_buf_size <= old_buf_size) { + tevent_req_nterror(req, NT_STATUS_INVALID_BUFFER_SIZE); + return; + } + buf = talloc_realloc(state, state->pdu_blob.data, uint8_t, new_buf_size); if (tevent_req_nomem(buf, req)) { return; |