sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-13 13:18:06 +03:00
Code

s3-schannel: fix api_pipe_schannel_process(), was using incorrect buffer length.

Browse Source 
Found by RPC-SCHANNEL torture test.

Guenther
This commit is contained in:
Günther Deschner 2009-09-12 23:25:00 +02:00
parent fac9c35f99
commit f900e61cf8
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
source3/rpc_server/srv_pipe.c
View File

@ -2199,11 +2199,13 @@ bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss
return False;
}
blob = data_blob_const(prs_data_p(rpc_in) + prs_offset(rpc_in), data_len);
blob = data_blob_const(prs_data_p(rpc_in) + prs_offset(rpc_in), auth_len);
ndr_err = ndr_pull_struct_blob(&blob, talloc_tos(), NULL, &schannel_chk,
(ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_SIGNATURE);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
DEBUG(0,("failed to pull NL_AUTH_SIGNATURE\n"));
dump_data(2, blob.data, blob.length);
return false;
}