sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-22 13:34:15 +03:00
Code

CVE-2016-2115: s4:libcli/raw: pass the minprotocol to smb_raw_negotiate*()

Browse Source 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11756

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
This commit is contained in:
Stefan Metzmacher 2016-02-27 04:15:38 +01:00
parent 57f0b0c6c0
commit 68d6c10e5e
4 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
source4/libcli/cliconnect.c
View File

@ -77,7 +77,7 @@ NTSTATUS smbcli_negprot(struct smbcli_state *cli, bool unicode, int maxprotocol)
return NT_STATUS_NO_MEMORY;
}
return smb_raw_negotiate(cli->transport, unicode, maxprotocol);
return smb_raw_negotiate(cli->transport, unicode, PROTOCOL_CORE, maxprotocol);
}
/* wrapper around smb_raw_sesssetup() */

7
source4/libcli/raw/rawnegotiate.c
View File

@ -37,6 +37,7 @@ static void smb_raw_negotiate_done(struct tevent_req *subreq);
struct tevent_req *smb_raw_negotiate_send(TALLOC_CTX *mem_ctx,
struct tevent_context *ev,
struct smbcli_transport *transport,
int minprotocol,
int maxprotocol)
{
struct tevent_req *req;
@ -58,7 +59,7 @@ struct tevent_req *smb_raw_negotiate_send(TALLOC_CTX *mem_ctx,
subreq = smbXcli_negprot_send(state, ev,
transport->conn,
timeout_msec,
PROTOCOL_CORE,
minprotocol,
maxprotocol);
if (tevent_req_nomem(subreq, req)) {
return tevent_req_post(req, ev);
@ -131,7 +132,8 @@ NTSTATUS smb_raw_negotiate_recv(struct tevent_req *req)
/*
Send a negprot command (sync interface)
*/
NTSTATUS smb_raw_negotiate(struct smbcli_transport *transport, bool unicode, int maxprotocol)
NTSTATUS smb_raw_negotiate(struct smbcli_transport *transport, bool unicode,
int minprotocol, int maxprotocol)
{
NTSTATUS status = NT_STATUS_INTERNAL_ERROR;
struct tevent_req *subreq = NULL;
@ -140,6 +142,7 @@ NTSTATUS smb_raw_negotiate(struct smbcli_transport *transport, bool unicode, int
subreq = smb_raw_negotiate_send(transport,
transport->ev,
transport,
minprotocol,
maxprotocol);
if (subreq == NULL) {
return NT_STATUS_NO_MEMORY;

1
source4/libcli/smb_composite/connect.c
View File

@ -297,6 +297,7 @@ static NTSTATUS connect_send_negprot(struct composite_context *c,
state->subreq = smb_raw_negotiate_send(state,
state->transport->ev,
state->transport,
state->transport->options.min_protocol,
state->transport->options.max_protocol);
NT_STATUS_HAVE_NO_MEMORY(state->subreq);
tevent_req_set_callback(state->subreq, subreq_handler, c);

1
source4/torture/basic/base.c
View File

@ -371,6 +371,7 @@ static bool run_negprot_nowait(struct torture_context *tctx)
struct tevent_req *req;
req = smb_raw_negotiate_send(cli, tctx->ev,
cli->transport,
PROTOCOL_CORE,
PROTOCOL_NT1);
tevent_loop_once(tctx->ev);
if (!tevent_req_is_in_progress(req)) {