sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-22 22:04:08 +03:00
Code

fixed the length checking for plaintext passwords (thanks to andrewb

Browse Source 
for spotting this)
(This used to be commit d4c905e5a0a67c8e01a4fcf78aa992a3b7beff02)
This commit is contained in:
Andrew Tridgell 2002-07-31 10:47:26 +00:00
parent 6be547fc6b
commit f5a85fe247
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
source3/smbd/sesssetup.c
View File

@ -634,6 +634,10 @@ int reply_sesssetup_and_X(connection_struct *conn, char *inbuf,char *outbuf,
return ERROR_DOS(ERRDOS,ERRbuftoosmall);
}
if (passlen1 > smb_buflen(inbuf)) {
return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
}
if (doencrypt) {
lm_resp = data_blob(smb_buf(inbuf), passlen1);
} else {
@ -694,14 +698,19 @@ int reply_sesssetup_and_X(connection_struct *conn, char *inbuf,char *outbuf,
if ((doencrypt) && (passlen1 != 0) && (passlen1 != 24)) {
doencrypt = False;
}
/* check for nasty tricks */
if (passlen1 > smb_buflen(inbuf) || passlen2 > smb_buflen(inbuf)) {
return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
}
if (doencrypt) {
lm_resp = data_blob(p, passlen1);
nt_resp = data_blob(p+passlen1, passlen2);
} else {
pstring pass;
srvstr_pull_buf(inbuf, pass, smb_buf(inbuf),
sizeof(pass), STR_TERMINATE);
srvstr_pull(inbuf, pass, smb_buf(inbuf),
sizeof(pass), passlen1, STR_TERMINATE);
plaintext_password = data_blob(pass, strlen(pass));
}