libsmb: Protect cli_oem_change_password() from rprcnt<2

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14362
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue May  5 17:12:04 UTC 2020 on sn-devel-184

diff --git a/source3/libsmb/clirap.c b/source3/libsmb/clirap.c
index 3f6711cd236d68e19ba5fcdc0ba7b0152b24f1de..e1f9cea43887b0f6ab0ea24bf561d7e9e5c9fc57 100644 (file)
--- a/source3/libsmb/clirap.c
+++ b/source3/libsmb/clirap.c
@@ -535,10 +535,16 @@ bool cli_oem_change_password(struct cli_state *cli, const char *user, const char
                return False;
        }
 
+       if (rdrcnt < 2) {
+               cli->rap_error = ERRbadformat;
+               goto done;
+       }
+
        if (rparam) {
                cli->rap_error = SVAL(rparam,0);
        }
 
+done:
        SAFE_FREE(rparam);
        SAFE_FREE(rdata);