CVE-2019-10218 - s3: libsmb: Protect SMB2 client code from evil server returned names.

Disconnect with NT_STATUS_INVALID_NETWORK_RESPONSE if so.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14071

Signed-off-by: Jeremy Allison <jra@samba.org>

diff --git a/source3/libsmb/cli_smb2_fnum.c b/source3/libsmb/cli_smb2_fnum.c
index 15f1420dd8f0a716afdded9ae14be1a88659ef56..4cae87853db23dbf9cd5ac25dbeb8f1e3c394d40 100644 (file)
--- a/source3/libsmb/cli_smb2_fnum.c
+++ b/source3/libsmb/cli_smb2_fnum.c
@@ -1442,6 +1442,13 @@ NTSTATUS cli_smb2_list(struct cli_state *cli,
                                goto fail;
                        }
 
+                       /* Protect against server attack. */
+                       status = is_bad_finfo_name(cli, finfo);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               smbXcli_conn_disconnect(cli->conn, status);
+                               goto fail;
+                       }
+
                        if (dir_check_ftype((uint32_t)finfo->mode,
                                        (uint32_t)attribute)) {
                                /*