From 7eb27f202b498c62385ad925717238bd12a1b82a Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Wed, 25 Sep 2013 23:25:12 +0200 Subject: [PATCH] CVE-2013-4408:s3:rpc_client: check for invalid frag_len in dcerpc_pull_ncacn_packet() Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185 Signed-off-by: Stefan Metzmacher Reviewed-by: Jeremy Allison --- source3/librpc/rpc/dcerpc_helpers.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/source3/librpc/rpc/dcerpc_helpers.c b/source3/librpc/rpc/dcerpc_helpers.c index d36c2da3838..a55e419fc13 100644 --- a/source3/librpc/rpc/dcerpc_helpers.c +++ b/source3/librpc/rpc/dcerpc_helpers.c @@ -127,6 +127,10 @@ NTSTATUS dcerpc_pull_ncacn_packet(TALLOC_CTX *mem_ctx, NDR_PRINT_DEBUG(ncacn_packet, r); } + if (r->frag_length != blob->length) { + return NT_STATUS_RPC_PROTOCOL_ERROR; + } + return NT_STATUS_OK; } -- 2.11.4.GIT