The branch, v3-6-test has been updated
via 1cfef70 Add check for invalid data size.
via abdb519 Merge branch 'v3-6-test' of
ssh://git.samba.org/data/git/samba into v3-6-test
via f892045 ntlmssp: when pushing an ntlmssp NEGOTIATE_MESSAGE deal
with NULL strings.
from 4e3bcaf s3: Fix some debug msgs in ntlm_auth
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-6-test
- Log -----------------------------------------------------------------
commit 1cfef7083cbeab838b1ea91aa5e0880ed24afe4c
Author: Jeremy Allison <[email protected]>
Date: Wed Sep 15 10:50:50 2010 -0700
Add check for invalid data size.
Jeremy.
(cherry picked from commit 627de92521cb20c5387656946bcbf5ecf3be5332)
commit abdb519c788d1c22fc9065f3a0dcd2c48f47b063
Merge: f892045fe06bac1079fe542fe426a42d8a2f17ac
4e3bcaf0074c021da0b2be424aec6f2de55900e5
Author: Jeremy Allison <[email protected]>
Date: Wed Sep 15 10:51:39 2010 -0700
Merge branch 'v3-6-test' of ssh://git.samba.org/data/git/samba into
v3-6-test
commit f892045fe06bac1079fe542fe426a42d8a2f17ac
Author: Günther Deschner <[email protected]>
Date: Tue Sep 14 17:57:23 2010 +0200
ntlmssp: when pushing an ntlmssp NEGOTIATE_MESSAGE deal with NULL strings.
Guenther
(cherry picked from commit 33da33c59e431f6f097bdd143fb48db465607669)
-----------------------------------------------------------------------
Summary of changes:
librpc/idl/ntlmssp.idl | 4 ++--
source3/smbd/nttrans.c | 9 ++++++++-
2 files changed, 10 insertions(+), 3 deletions(-)
Changeset truncated at 500 lines:
diff --git a/librpc/idl/ntlmssp.idl b/librpc/idl/ntlmssp.idl
index e26dc31..b9be7da 100644
--- a/librpc/idl/ntlmssp.idl
+++ b/librpc/idl/ntlmssp.idl
@@ -105,10 +105,10 @@ interface ntlmssp
[charset(DOS),value("NTLMSSP")] uint8 Signature[8];
[value(NtLmNegotiate)] ntlmssp_MessageType MessageType;
NEGOTIATE NegotiateFlags;
- [value(strlen(DomainName))] uint16 DomainNameLen;
+ [value(DomainName ? strlen(DomainName) : 0)] uint16
DomainNameLen;
[value(DomainNameLen)] uint16 DomainNameMaxLen;
[relative] [subcontext(0),subcontext_size(DomainNameLen)]
[flag(ndr_ntlmssp_negotiated_string_flags(NTLMSSP_NEGOTIATE_OEM))] string
*DomainName;
- [value(strlen(Workstation))] uint16 WorkstationLen;
+ [value(Workstation ? strlen(Workstation) : 0)] uint16
WorkstationLen;
[value(WorkstationLen)] uint16 WorkstationMaxLen;
[relative] [subcontext(0),subcontext_size(WorkstationLen)]
[flag(ndr_ntlmssp_negotiated_string_flags(NTLMSSP_NEGOTIATE_OEM))] string
*Workstation;
[switch_is(NegotiateFlags & NTLMSSP_NEGOTIATE_VERSION)]
ntlmssp_Version Version;
diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c
index ac5cc2f..a0ea0d6 100644
--- a/source3/smbd/nttrans.c
+++ b/source3/smbd/nttrans.c
@@ -2236,7 +2236,7 @@ static void call_nt_transact_ioctl(connection_struct
*conn,
*/
struct dom_sid sid;
uid_t uid;
- size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
+ size_t sid_len;
DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on
FID[0x%04X]\n",fidnum));
@@ -2244,6 +2244,13 @@ static void call_nt_transact_ioctl(connection_struct
*conn,
return;
}
+ if (data_count < 8) {
+ reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+ return;
+ }
+
+ sid_len = MIN(data_count-4,SID_MAX_SIZE);
+
/* unknown 4 bytes: this is not the length of the sid :-( */
/*unknown = IVAL(pdata,0);*/
--
Samba Shared Repository
