From e6da619500da08cb5b60f723c229ad79a4d9b6ca Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Sat, 27 Jun 2015 10:31:48 +0200 Subject: [PATCH] CVE-2015-5370: s4:librpc/rpc: avoid dereferencing sec->auth_info in dcerpc_request_prepare_vt() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit BUG: https://bugzilla.samba.org/show_bug.cgi?id=11344 Signed-off-by: Stefan Metzmacher Reviewed-by: Günther Deschner --- source4/librpc/rpc/dcerpc.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/source4/librpc/rpc/dcerpc.c b/source4/librpc/rpc/dcerpc.c index 0ae15a660b7..ae9c79db097 100644 --- a/source4/librpc/rpc/dcerpc.c +++ b/source4/librpc/rpc/dcerpc.c @@ -1641,11 +1641,7 @@ static NTSTATUS dcerpc_request_prepare_vt(struct rpc_request *req) struct ndr_push *ndr = NULL; enum ndr_err_code ndr_err; - if (sec->auth_info == NULL) { - return NT_STATUS_OK; - } - - if (sec->auth_info->auth_level < DCERPC_AUTH_LEVEL_INTEGRITY) { + if (sec->auth_level < DCERPC_AUTH_LEVEL_INTEGRITY) { return NT_STATUS_OK; }