sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-08 21:18:16 +03:00
Code

libcli/smb: fix error checking in smb2_signing_decrypt_pdu() invalid ptext_len

Browse Source 
When the ptext_size != m_total check fails, we call this:

   status = gnutls_error_to_ntstatus(rc, NT_STATUS_INTERNAL_ERROR);
   goto out;

As rc is 0 at that point we'll exit smb2_signing_decrypt_pdu()
with NT_STATUS_OK, but without copying the decrypted data
back into the callers buffer. Which leads to strange errors
in the caller.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14968

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 99182af4ab)
This commit is contained in:
Stefan Metzmacher 2022-01-31 20:33:43 +01:00 committed by Jule Anger
parent f75a058851
commit bbd4cd045a
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libcli/smb/smb2_signing.c
View File

@ -773,12 +773,19 @@ NTSTATUS smb2_signing_decrypt_pdu(struct smb2_signing_key *decryption_key,
ctext_size,
ptext,
&ptext_size);
if (rc < 0 || ptext_size != m_total) {
if (rc < 0) {
TALLOC_FREE(ptext);
TALLOC_FREE(ctext);
status = gnutls_error_to_ntstatus(rc, NT_STATUS_INTERNAL_ERROR);
goto out;
}
if (ptext_size != m_total) {
TALLOC_FREE(ptext);
TALLOC_FREE(ctext);
rc = GNUTLS_E_SHORT_MEMORY_BUFFER;
status = gnutls_error_to_ntstatus(rc, NT_STATUS_INTERNAL_ERROR);
goto out;
}
len = 0;
for (i = 1; i < count; i++) {