s4:gensec_tstream: allow wrapped messages up to a size of 0xfffffff

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11872

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
(cherry picked from commit 8704958fb3b212b401a8e7d94fdd9c627adbde0d)

diff --git a/source4/auth/gensec/gensec_tstream.c b/source4/auth/gensec/gensec_tstream.c
index 92f4fa6687cef7921a7e07577a526047842ef774..c828170b1709ed2291d4446fd214005a5799db0b 100644 (file)
--- a/source4/auth/gensec/gensec_tstream.c
+++ b/source4/auth/gensec/gensec_tstream.c
@@ -253,7 +253,11 @@ static int tstream_gensec_readv_next_vector(struct tstream_context *unix_stream,
 
                msg_len = RIVAL(state->wrapped.hdr, 0);
 
-               if (msg_len > 0x00FFFFFF) {
+               /*
+                * I got a Windows 2012R2 server responding with
+                * a message of 0x1b28a33.
+                */
+               if (msg_len > 0x0FFFFFFF) {
                        errno = EMSGSIZE;
                        return -1;
                }