sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-08 21:18:16 +03:00
Code

librpc: add SMB_ASSERT(blob->length >= DCERPC_NCACN_PAYLOAD_OFFSET) protection

Browse Source 
A lot of functions rely on having the 16 bytes dcerpc header to operate
on. This makes it more obvious and makes sure they can't be misused in
future.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
This commit is contained in:
Stefan Metzmacher 2018-12-24 11:21:38 +01:00 committed by Jeremy Allison
parent c919514d2d
commit a94c4e55b7
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
librpc/rpc/dcerpc_util.c
View File

@ -34,6 +34,8 @@
decode */
void dcerpc_set_frag_length(DATA_BLOB *blob, uint16_t v)
{
SMB_ASSERT(blob->length >= DCERPC_NCACN_PAYLOAD_OFFSET);
if (CVAL(blob->data,DCERPC_DREP_OFFSET) & DCERPC_DREP_LE) {
SSVAL(blob->data, DCERPC_FRAG_LEN_OFFSET, v);
} else {
@ -43,6 +45,8 @@ void dcerpc_set_frag_length(DATA_BLOB *blob, uint16_t v)
uint16_t dcerpc_get_frag_length(const DATA_BLOB *blob)
{
SMB_ASSERT(blob->length >= DCERPC_NCACN_PAYLOAD_OFFSET);
if (CVAL(blob->data,DCERPC_DREP_OFFSET) & DCERPC_DREP_LE) {
return SVAL(blob->data, DCERPC_FRAG_LEN_OFFSET);
} else {
@ -52,6 +56,8 @@ uint16_t dcerpc_get_frag_length(const DATA_BLOB *blob)
void dcerpc_set_auth_length(DATA_BLOB *blob, uint16_t v)
{
SMB_ASSERT(blob->length >= DCERPC_NCACN_PAYLOAD_OFFSET);
if (CVAL(blob->data,DCERPC_DREP_OFFSET) & DCERPC_DREP_LE) {
SSVAL(blob->data, DCERPC_AUTH_LEN_OFFSET, v);
} else {
@ -61,6 +67,8 @@ void dcerpc_set_auth_length(DATA_BLOB *blob, uint16_t v)
uint16_t dcerpc_get_auth_length(const DATA_BLOB *blob)
{
SMB_ASSERT(blob->length >= DCERPC_NCACN_PAYLOAD_OFFSET);
if (CVAL(blob->data,DCERPC_DREP_OFFSET) & DCERPC_DREP_LE) {
return SVAL(blob->data, DCERPC_AUTH_LEN_OFFSET);
} else {
@ -70,6 +78,8 @@ uint16_t dcerpc_get_auth_length(const DATA_BLOB *blob)
uint8_t dcerpc_get_endian_flag(DATA_BLOB *blob)
{
SMB_ASSERT(blob->length >= DCERPC_NCACN_PAYLOAD_OFFSET);
return blob->data[DCERPC_DREP_OFFSET];
}