diff options
| author | Stefan Metzmacher <metze@samba.org> | 2013-09-25 23:25:12 +0200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2013-12-05 10:18:09 +0100 |
| commit | 895ce91f8d97f95f0eb630781abf732bd5a3c9ef (patch) | |
| tree | 9504fed211173c3bb0d86f8edf6f75c8ce16ed0f | |
| parent | c4a1b2ede499b38bda7bcf08f3d985b5396342f8 (diff) | |
| download | samba-895ce91f8d97f95f0eb630781abf732bd5a3c9ef.tar.gz | |
CVE-2013-4408:s3:rpc_client: check for invalid frag_len in dcerpc_pull_ncacn_packet()
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
| -rw-r--r-- | source3/librpc/rpc/dcerpc_helpers.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/source3/librpc/rpc/dcerpc_helpers.c b/source3/librpc/rpc/dcerpc_helpers.c index d36c2da383..a55e419fc1 100644 --- a/source3/librpc/rpc/dcerpc_helpers.c +++ b/source3/librpc/rpc/dcerpc_helpers.c @@ -127,6 +127,10 @@ NTSTATUS dcerpc_pull_ncacn_packet(TALLOC_CTX *mem_ctx, NDR_PRINT_DEBUG(ncacn_packet, r); } + if (r->frag_length != blob->length) { + return NT_STATUS_RPC_PROTOCOL_ERROR; + } + return NT_STATUS_OK; } |