Author: jerry
Date: 2007-05-30 23:06:48 +0000 (Wed, 30 May 2007)
New Revision: 23256

WebSVN: 
http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=23256

Log:
fix length and siglen checks in pac_io_pac_signature_data()
Modified:
   branches/SAMBA_3_0_26/source/libads/authdata.c


Changeset:
Modified: branches/SAMBA_3_0_26/source/libads/authdata.c
===================================================================
--- branches/SAMBA_3_0_26/source/libads/authdata.c      2007-05-30 22:57:46 UTC 
(rev 23255)
+++ branches/SAMBA_3_0_26/source/libads/authdata.c      2007-05-30 23:06:48 UTC 
(rev 23256)
@@ -451,10 +451,11 @@
                                      PAC_SIGNATURE_DATA *data, uint32 length,
                                      prs_struct *ps, int depth)
 {
-       uint32 siglen = length - sizeof(uint32);
+       uint32 siglen = 0;
+
        prs_debug(ps, depth, desc, "pac_io_pac_signature_data");
        depth++;
-       
+
        if (data == NULL)
                return False;
 
@@ -463,6 +464,9 @@
        if (!prs_uint32("type", ps, depth, &data->type))
                return False;
 
+       if ( length > sizeof(uint32) )
+               siglen = length - sizeof(uint32);       
+
        if (UNMARSHALLING(ps) && length) {
                if (siglen) {
                        data->signature.buffer = PRS_ALLOC_MEM(ps, uint8, 
siglen);

Reply via email to