Revert "dcerpc_util: let dcerpc_pull_auth_trailer() check that auth_offset is 4 bytes...
authorStefan Metzmacher <metze@samba.org>
Wed, 10 Jan 2024 16:04:01 +0000 (17:04 +0100)
committerStefan Metzmacher <metze@samba.org>
Thu, 8 Feb 2024 15:39:20 +0000 (16:39 +0100)
This reverts commit e1835f50e1c2ca7abea655a9bbc0ae80e1d17866.

librpc/rpc/dcerpc_util.c

index 5ea3c984749c5ae47660f837796b1006345518fc..e6f7fa634a92749e2ef61c993140efd3df918c26 100644 (file)
@@ -239,10 +239,8 @@ NTSTATUS dcerpc_pull_auth_trailer(const struct ncacn_packet *pkt,
        enum ndr_err_code ndr_err;
        uint16_t data_and_pad;
        uint16_t auth_length;
-       uint16_t auth_offset;
        uint32_t tmp_length;
        uint32_t max_pad_len = 0;
-       DATA_BLOB auth_blob;
 
        ZERO_STRUCTP(auth);
        if (_auth_length != NULL) {
@@ -282,16 +280,8 @@ NTSTATUS dcerpc_pull_auth_trailer(const struct ncacn_packet *pkt,
        }
 
        data_and_pad = pkt_trailer->length - auth_length;
-       auth_offset = pkt->frag_length - auth_length;
-       if ((auth_offset % 4) != 0) {
-               DBG_WARNING("auth_offset[%u] not 4 byte aligned\n",
-                           (unsigned)auth_offset);
-               return NT_STATUS_RPC_PROTOCOL_ERROR;
-       }
 
-       auth_blob = data_blob_const(pkt_trailer->data + data_and_pad,
-                                   auth_length);
-       ndr = ndr_pull_init_blob(&auth_blob, mem_ctx);
+       ndr = ndr_pull_init_blob(pkt_trailer, mem_ctx);
        if (!ndr) {
                return NT_STATUS_NO_MEMORY;
        }
@@ -300,6 +290,12 @@ NTSTATUS dcerpc_pull_auth_trailer(const struct ncacn_packet *pkt,
                ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
        }
 
+       ndr_err = ndr_pull_advance(ndr, data_and_pad);
+       if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+               talloc_free(ndr);
+               return ndr_map_error2ntstatus(ndr_err);
+       }
+
        ndr_err = ndr_pull_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, auth);
        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                talloc_free(ndr);