s4:rpc_server: correctly handle dcerpc requests with object uuids

[kai/samba.git] / source4 / rpc_server / dcerpc_server.c

diff --git a/source4/rpc_server/dcerpc_server.c b/source4/rpc_server/dcerpc_server.c
index fa7b8d26f5c72fe0c57ffb6d47e1f957da898b84..893055d3b1ad70f078b2541edc38acccdaa174e2 100644 (file)
--- a/source4/rpc_server/dcerpc_server.c
+++ b/source4/rpc_server/dcerpc_server.c
@@ -870,10 +870,6 @@ static NTSTATUS dcesrv_request(struct dcesrv_call_state *call)
        call->context   = context;
        call->ndr_pull  = pull;
 
-       if (call->pkt.pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
-               pull->flags |= LIBNDR_FLAG_OBJECT_PRESENT;
-       }
-
        if (!(call->pkt.drep[0] & DCERPC_DREP_LE)) {
                pull->flags |= LIBNDR_FLAG_BIGENDIAN;
        }
@@ -951,13 +947,16 @@ _PUBLIC_ NTSTATUS dcesrv_reply(struct dcesrv_call_state *call)
           request header size */
        chunk_size = call->conn->cli_max_recv_frag;
        chunk_size -= DCERPC_REQUEST_LENGTH;
-       if (call->conn->auth_state.gensec_security) {
-               chunk_size -= DCERPC_AUTH_TRAILER_LENGTH;
+       if (call->conn->auth_state.auth_info &&
+           call->conn->auth_state.gensec_security) {
                sig_size = gensec_sig_size(call->conn->auth_state.gensec_security,
                                           call->conn->cli_max_recv_frag);
-               chunk_size -= sig_size;
-               chunk_size -= (chunk_size % 16);
+               if (sig_size) {
+                       chunk_size -= DCERPC_AUTH_TRAILER_LENGTH;
+                       chunk_size -= sig_size;
+               }
        }
+       chunk_size -= (chunk_size % 16);
 
        do {
                uint32_t length;
@@ -1109,6 +1108,10 @@ NTSTATUS dcesrv_input_process(struct dcesrv_connection *dce_conn)
                ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
        }
 
+       if (CVAL(blob.data, DCERPC_PFC_OFFSET) & DCERPC_PFC_FLAG_OBJECT_UUID) {
+               ndr->flags |= LIBNDR_FLAG_OBJECT_PRESENT;
+       }
+
        ndr_err = ndr_pull_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, &call->pkt);
        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                talloc_free(dce_conn->partial_input.data);