CVE-2015-5370: s3:rpc_server: check the transfer syntax in check_bind_req() first

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11344

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>

diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c
index e4e40f1628304eba08281ba9bf44fe46401c0f39..27fd83cab69a8cf945951b6deb51694b4246b7c0 100644 (file)
--- a/source3/rpc_server/srv_pipe.c
+++ b/source3/rpc_server/srv_pipe.c
@@ -350,20 +350,30 @@ static bool check_bind_req(struct pipes_struct *p,
        bool ok;
        const char *interface_name = NULL;
 
-       DEBUG(3,("check_bind_req for %s\n",
+       DEBUG(3,("check_bind_req for %s context_id=%u\n",
                 ndr_interface_name(&abstract->uuid,
-                                   abstract->if_version)));
+                                   abstract->if_version),
+                (unsigned)context_id));
+
+       ok = ndr_syntax_id_equal(transfer, &ndr_transfer_syntax_ndr);
+       if (!ok) {
+               DEBUG(1,("check_bind_req unknown transfer syntax for "
+                        "%s context_id=%u\n",
+                        ndr_interface_name(&abstract->uuid,
+                                   abstract->if_version),
+                        (unsigned)context_id));
+               return false;
+       }
 
        /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
-       if (rpc_srv_pipe_exists_by_id(abstract) &&
-          ndr_syntax_id_equal(transfer, &ndr_transfer_syntax_ndr)) {
-               DEBUG(3, ("check_bind_req: %s -> %s rpc service\n",
-                         rpc_srv_get_pipe_cli_name(abstract),
-                         rpc_srv_get_pipe_srv_name(abstract)));
-       } else {
+       if (!rpc_srv_pipe_exists_by_id(abstract)) {
                return false;
        }
 
+       DEBUG(3, ("check_bind_req: %s -> %s rpc service\n",
+                 rpc_srv_get_pipe_cli_name(abstract),
+                 rpc_srv_get_pipe_srv_name(abstract)));
+
        ok = init_pipe_handles(p, abstract);
        if (!ok) {
                DEBUG(1, ("Failed to init pipe handles!\n"));