From abf018e8b64b237aa029978c20bd418524fff3d0 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 17 Aug 2012 08:31:52 +0200 Subject: [PATCH] libcli/smb: make sure the SMB2_TRANSFORM pdu is complete metze --- libcli/smb/smbXcli_base.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c index a9adcbb0b700..02d022763717 100644 --- a/libcli/smb/smbXcli_base.c +++ b/libcli/smb/smbXcli_base.c @@ -3041,6 +3041,7 @@ static NTSTATUS smb2cli_inbuf_parse_compound(struct smbXcli_conn *conn, struct smbXcli_session *s; uint64_t uid; struct iovec tf_iov[2]; + size_t enc_len; NTSTATUS status; if (len < SMB2_TF_HDR_SIZE) { @@ -3053,9 +3054,16 @@ static NTSTATUS smb2cli_inbuf_parse_compound(struct smbXcli_conn *conn, taken += tf_len; hdr = first_hdr + taken; - len = IVAL(tf, SMB2_TF_MSG_SIZE); + enc_len = IVAL(tf, SMB2_TF_MSG_SIZE); uid = BVAL(tf, SMB2_TF_SESSION_ID); + if (len < SMB2_TF_HDR_SIZE + enc_len) { + DEBUG(10, ("%d bytes left, expected at least %d\n", + (int)len, + (int)(SMB2_TF_HDR_SIZE + enc_len))); + goto inval; + } + s = conn->sessions; for (; s; s = s->next) { if (s->smb2->session_id != uid) { @@ -3073,7 +3081,7 @@ static NTSTATUS smb2cli_inbuf_parse_compound(struct smbXcli_conn *conn, tf_iov[0].iov_base = (void *)tf; tf_iov[0].iov_len = tf_len; tf_iov[1].iov_base = (void *)hdr; - tf_iov[1].iov_len = len; + tf_iov[1].iov_len = enc_len; status = smb2_signing_decrypt_pdu(s->smb2->decryption_key, conn->protocol, @@ -3083,7 +3091,8 @@ static NTSTATUS smb2cli_inbuf_parse_compound(struct smbXcli_conn *conn, return status; } - verified_buflen = taken + len; + verified_buflen = taken + enc_len; + len = enc_len; } /* -- 2.34.1