libcli/echo: validate the message length

metze

diff --git a/libcli/echo/echo.c b/libcli/echo/echo.c
index b6005cb32c07f94f1024d01374a6f6ae0393e177..0f5f7f77b169de5f60e3c82854b85c13663bcdd7 100644 (file)
--- a/libcli/echo/echo.c
+++ b/libcli/echo/echo.c
@@ -172,6 +172,11 @@ static void echo_request_done(struct tevent_req *subreq)
                return;
        }
 
+       if (len != state->orig_len) {
+               tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
+               return;
+       }
+
        state->message[len-1] = '\0';
        /* Once the async function has completed, set tevent_req_done() */
        tevent_req_done(req);