Author: jerry Date: 2007-05-30 23:06:48 +0000 (Wed, 30 May 2007) New Revision: 23256
WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=23256 Log: fix length and siglen checks in pac_io_pac_signature_data() Modified: branches/SAMBA_3_0_26/source/libads/authdata.c Changeset: Modified: branches/SAMBA_3_0_26/source/libads/authdata.c =================================================================== --- branches/SAMBA_3_0_26/source/libads/authdata.c 2007-05-30 22:57:46 UTC (rev 23255) +++ branches/SAMBA_3_0_26/source/libads/authdata.c 2007-05-30 23:06:48 UTC (rev 23256) @@ -451,10 +451,11 @@ PAC_SIGNATURE_DATA *data, uint32 length, prs_struct *ps, int depth) { - uint32 siglen = length - sizeof(uint32); + uint32 siglen = 0; + prs_debug(ps, depth, desc, "pac_io_pac_signature_data"); depth++; - + if (data == NULL) return False; @@ -463,6 +464,9 @@ if (!prs_uint32("type", ps, depth, &data->type)) return False; + if ( length > sizeof(uint32) ) + siglen = length - sizeof(uint32); + if (UNMARSHALLING(ps) && length) { if (siglen) { data->signature.buffer = PRS_ALLOC_MEM(ps, uint8, siglen);
