svn commit: samba r10873 - in branches/SAMBA_4_0/source/librpc/ndr: .

[metze at samba.org]

Author: metze
Date: 2005-10-10 14:10:37 +0000 (Mon, 10 Oct 2005)
New Revision: 10873

WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=10873

Log:
check the complete payload header

metze
Modified:
   branches/SAMBA_4_0/source/librpc/ndr/ndr_compression.c


Changeset:
Modified: branches/SAMBA_4_0/source/librpc/ndr/ndr_compression.c
===================================================================
--- branches/SAMBA_4_0/source/librpc/ndr/ndr_compression.c	2005-10-10 13:25:11 UTC (rev 10872)
+++ branches/SAMBA_4_0/source/librpc/ndr/ndr_compression.c	2005-10-10 14:10:37 UTC (rev 10873)
@@ -116,14 +116,22 @@
 	NDR_CHECK(ndr_pull_uint32(comndr, NDR_SCALARS, &payload_header[2]));
 	NDR_CHECK(ndr_pull_uint32(comndr, NDR_SCALARS, &payload_header[3]));
 
-	payload_size = payload_header[2];
-
-	/* TODO: check the first 4 bytes of the header */
+	if (payload_header[0] != 0x00081001) {
+		return ndr_pull_error(subndr, NDR_ERR_COMPRESSION, "Bad MSZIP payload_header[0] [0x%08X] != [0x00081001] (PULL)",
+				      payload_header[0]);
+	}
 	if (payload_header[1] != 0xCCCCCCCC) {
 		return ndr_pull_error(subndr, NDR_ERR_COMPRESSION, "Bad MSZIP payload_header[1] [0x%08X] != [0xCCCCCCCC] (PULL)",
 				      payload_header[1]);
 	}
 
+	payload_size = payload_header[2];
+
+	if (payload_header[3] != 0x00000000) {
+		return ndr_pull_error(subndr, NDR_ERR_COMPRESSION, "Bad MSZIP payload_header[3] [0x%08X] != [0x00000000] (PULL)",
+				      payload_header[3]);
+	}
+
 	payload_offset = comndr->offset;
 	NDR_CHECK(ndr_pull_advance(comndr, payload_size));
 	payload = comndr->data + payload_offset;