svn commit: samba r23256 - in branches/SAMBA_3_0_26/source/libads: .

[jerry at samba.org]

Author: jerry
Date: 2007-05-30 23:06:48 +0000 (Wed, 30 May 2007)
New Revision: 23256

WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=23256

Log:
fix length and siglen checks in pac_io_pac_signature_data()
Modified:
   branches/SAMBA_3_0_26/source/libads/authdata.c


Changeset:
Modified: branches/SAMBA_3_0_26/source/libads/authdata.c
===================================================================
--- branches/SAMBA_3_0_26/source/libads/authdata.c	2007-05-30 22:57:46 UTC (rev 23255)
+++ branches/SAMBA_3_0_26/source/libads/authdata.c	2007-05-30 23:06:48 UTC (rev 23256)
@@ -451,10 +451,11 @@
 				      PAC_SIGNATURE_DATA *data, uint32 length,
 				      prs_struct *ps, int depth)
 {
-	uint32 siglen = length - sizeof(uint32);
+	uint32 siglen = 0;
+
 	prs_debug(ps, depth, desc, "pac_io_pac_signature_data");
 	depth++;
-	
+
 	if (data == NULL)
 		return False;
 
@@ -463,6 +464,9 @@
 	if (!prs_uint32("type", ps, depth, &data->type))
 		return False;
 
+	if ( length > sizeof(uint32) )
+		siglen = length - sizeof(uint32);	
+
 	if (UNMARSHALLING(ps) && length) {
 		if (siglen) {
 			data->signature.buffer = PRS_ALLOC_MEM(ps, uint8, siglen);