From: Stefan Metzmacher <metze@samba.org>
Date: Fri, 22 Apr 2016 14:18:24 +0000 (+0200)
Subject: s4:gensec_tstream: allow wrapped messages up to a size of 0xfffffff
X-Git-Tag: samba-4.2.12~33
X-Git-Url: http://git.samba.org/?p=samba.git;a=commitdiff_plain;h=2bebe8012f711c633bcc6d7d706ad242fdc9544e

s4:gensec_tstream: allow wrapped messages up to a size of 0xfffffff

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11872

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
(cherry picked from commit 8704958fb3b212b401a8e7d94fdd9c627adbde0d)
---

diff --git a/source4/auth/gensec/gensec_tstream.c b/source4/auth/gensec/gensec_tstream.c
index 92f4fa6687c..c828170b170 100644
--- a/source4/auth/gensec/gensec_tstream.c
+++ b/source4/auth/gensec/gensec_tstream.c
@@ -253,7 +253,11 @@ static int tstream_gensec_readv_next_vector(struct tstream_context *unix_stream,
 
 		msg_len = RIVAL(state->wrapped.hdr, 0);
 
-		if (msg_len > 0x00FFFFFF) {
+		/*
+		 * I got a Windows 2012R2 server responding with
+		 * a message of 0x1b28a33.
+		 */
+		if (msg_len > 0x0FFFFFFF) {
 			errno = EMSGSIZE;
 			return -1;
 		}