[SCM] Samba Shared Repository - branch v3-5-test updated

[Karolin Seeger]

The branch, v3-5-test has been updated
       via  c5bf8ac s3:libsmb: check the wct of the incoming SMBnegprot responses
      from  126d343 v3-5-test: Fix getent group if trusted domains are not reachable

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-5-test


- Log -----------------------------------------------------------------
commit c5bf8ac4ee60fe808a2593a5ece12e8bfad5695b
Author: Stefan Metzmacher <metze at samba.org>
Date:   Mon Sep 12 12:10:54 2011 -0700

    s3:libsmb: check the wct of the incoming SMBnegprot responses
    
    metze
    
    Fix bug #8452 (negprot reply needs to check vwv vector length).
    
    The corresponding commit in master is 85332eb1c721d585e1a33101bddafdca4073e10f.

-----------------------------------------------------------------------

Summary of changes:
 source3/libsmb/cliconnect.c |   10 ++++++++++
 1 files changed, 10 insertions(+), 0 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
index 6316db1..7606810 100644
--- a/source3/libsmb/cliconnect.c
+++ b/source3/libsmb/cliconnect.c
@@ -1700,6 +1700,11 @@ static void cli_negprot_done(struct tevent_req *subreq)
 		struct timespec ts;
 		bool negotiated_smb_signing = false;
 
+		if (wct != 0x11) {
+			tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
+			return;
+		}
+
 		/* NT protocol */
 		cli->sec_mode = CVAL(vwv + 1, 0);
 		cli->max_mux = SVAL(vwv + 1, 1);
@@ -1765,6 +1770,11 @@ static void cli_negprot_done(struct tevent_req *subreq)
 		}
 
 	} else if (cli->protocol >= PROTOCOL_LANMAN1) {
+		if (wct != 0x0D) {
+			tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
+			return;
+		}
+
 		cli->use_spnego = False;
 		cli->sec_mode = SVAL(vwv + 1, 0);
 		cli->max_xmit = SVAL(vwv + 2, 0);


-- 
Samba Shared Repository