From 4e74d811aa9f85a4cb7896c0fcc21552d1910cf5 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Thu, 5 Mar 2009 21:06:48 -0800 Subject: [PATCH] Now we're allowing a lower bound for auth_len, ensure we also check for an upper one (integer wrap). Jeremy. --- source3/rpc_server/srv_pipe.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c index ac491b9e53c..6becfa42e86 100644 --- a/source3/rpc_server/srv_pipe.c +++ b/source3/rpc_server/srv_pipe.c @@ -2113,7 +2113,11 @@ bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss auth_len = p->hdr.auth_len; - if (auth_len < RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) { + if (auth_len < RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN || + auth_len < RPC_HEADER_LEN + + RPC_HDR_REQ_LEN + + RPC_HDR_AUTH_LEN + + auth_len) { DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len )); return False; } -- 2.34.1