diff options
| author | Stefan Metzmacher <metze@samba.org> | 2013-09-24 05:03:40 +0200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2013-12-05 10:18:09 +0100 |
| commit | c4a1b2ede499b38bda7bcf08f3d985b5396342f8 (patch) | |
| tree | fabf8a82976cd85e7a049aa4726330d164adb66a /librpc | |
| parent | 78b49899e75cd692c595bf1ce5ed4158a97673e6 (diff) | |
| download | samba-c4a1b2ede499b38bda7bcf08f3d985b5396342f8.tar.gz | |
CVE-2013-4408:librpc: check for invalid frag_len within dcerpc_read_ncacn_packet_next_vector()
We should do this explicit instead of relying on
tstream_readv_pdu_ask_for_next_vector() to catch the overflow.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Diffstat (limited to 'librpc')
| -rw-r--r-- | librpc/rpc/dcerpc_util.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/librpc/rpc/dcerpc_util.c b/librpc/rpc/dcerpc_util.c index 458ecc544e..0b9cca3d25 100644 --- a/librpc/rpc/dcerpc_util.c +++ b/librpc/rpc/dcerpc_util.c @@ -223,6 +223,15 @@ static int dcerpc_read_ncacn_packet_next_vector(struct tstream_context *stream, ofs = state->buffer.length; + if (frag_len < ofs) { + /* + * something is wrong, let the caller deal with it + */ + *_vector = NULL; + *_count = 0; + return 0; + } + state->buffer.data = talloc_realloc(state, state->buffer.data, uint8_t, frag_len); |