The branch, v3-0-test has been updated via f03bacbf695f877d27186a39755ae726a22a61c8 (commit) from 7274d5691a339087f2770acf2f954830506f5cdc (commit)
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-0-test - Log ----------------------------------------------------------------- commit f03bacbf695f877d27186a39755ae726a22a61c8 Author: Jeremy Allison <j...@samba.org> Date: Thu Mar 5 20:59:48 2009 -0800 Now we're allowing a lower bound for auth_len, ensure we also check for an upper one (integer wrap). Jeremy. ----------------------------------------------------------------------- Summary of changes: source/rpc_server/srv_pipe.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) Changeset truncated at 500 lines: diff --git a/source/rpc_server/srv_pipe.c b/source/rpc_server/srv_pipe.c index d491bc2..868f4d0 100644 --- a/source/rpc_server/srv_pipe.c +++ b/source/rpc_server/srv_pipe.c @@ -2062,7 +2062,11 @@ BOOL api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss auth_len = p->hdr.auth_len; - if (auth_len < RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) { + if (auth_len < RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN || + auth_len < RPC_HEADER_LEN + + RPC_HDR_REQ_LEN + + RPC_HDR_AUTH_LEN + + auth_len) { DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len )); return False; } -- Samba Shared Repository