s3-schannel: fix api_pipe_schannel_process(), was using incorrect buffer length.

Found by RPC-SCHANNEL torture test.

Guenther

diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c
index 7be0a0d2d2d18fe8bbbc16696dfb0c1146283502..ce7df63972abafc6e14c2163303a756b0447b512 100644 (file)
--- a/source3/rpc_server/srv_pipe.c
+++ b/source3/rpc_server/srv_pipe.c
@@ -2199,11 +2199,13 @@ bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss
                return False;
        }
 
-       blob = data_blob_const(prs_data_p(rpc_in) + prs_offset(rpc_in), data_len);
+       blob = data_blob_const(prs_data_p(rpc_in) + prs_offset(rpc_in), auth_len);
 
        ndr_err = ndr_pull_struct_blob(&blob, talloc_tos(), NULL, &schannel_chk,
                               (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_SIGNATURE);
        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+               DEBUG(0,("failed to pull NL_AUTH_SIGNATURE\n"));
+               dump_data(2, blob.data, blob.length);
                return false;
        }