sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-24 02:04:21 +03:00
Code

smbXsrv_client: correctly check in negotiate_request.length smbXsrv_client_connection_pass[ed]_*

Browse Source 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15159

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 21ef01e7b8368caa050ed82b9d787d1679220b2b)
This commit is contained in:
Stefan Metzmacher 2022-08-30 16:56:12 +02:00 committed by Jule Anger
parent 1a4d3a2db7
commit ada5ef9d84
1 changed files with 17 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
source3/smbd/smbXsrv_client.c
View File

@ -572,10 +572,6 @@ static bool smb2srv_client_mc_negprot_filter(struct messaging_rec *rec, void *pr
return false;
}
if (rec->buf.length < SMB2_HDR_BODY) {
return false;
}
return true;
}
@ -665,6 +661,14 @@ static void smb2srv_client_mc_negprot_done(struct tevent_req *subreq)
return;
}
if (passed_info0->negotiate_request.length != 0) {
DBG_ERR("negotiate_request.length[%zu]\n",
passed_info0->negotiate_request.length);
NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
return;
}
tevent_req_nterror(req, NT_STATUS_MESSAGE_RETRIEVED);
}
@ -883,12 +887,6 @@ static bool smbXsrv_client_connection_pass_filter(struct messaging_rec *rec, voi
return false;
}
if (rec->buf.length < SMB2_HDR_BODY) {
return false;
}
/* TODO: verify client_guid...? */
return true;
}
@ -981,6 +979,15 @@ static void smbXsrv_client_connection_pass_loop(struct tevent_req *subreq)
goto next;
}
if (pass_info0->negotiate_request.length < SMB2_HDR_BODY) {
DBG_WARNING("negotiate_request.length[%zu]\n",
pass_info0->negotiate_request.length);
if (DEBUGLVL(DBGLVL_WARNING)) {
NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
}
goto next;
}
status = smb2srv_client_connection_passed(client, pass_info0);
if (!NT_STATUS_IS_OK(status)) {
const char *r = "smb2srv_client_connection_passed() failed";