Changeset 587 for vendor/current/source3/libsmb

Timestamp:

Jun 29, 2011, 7:36:41 AM (14 years ago)

Author:

Herwig Bauernfeind

Message:

Samba 3.5: Update vendor to version 3.5.6

Location:

vendor/current/source3/libsmb

Files:

• cliconnect.c (modified) (4 diffs)
• clikrb5.c (modified) (9 diffs)
• climessage.c (modified) (2 diffs)
• clispnego.c (modified) (3 diffs)
• nmblib.c (modified) (4 diffs)

vendor/current/source3/libsmb/cliconnect.c

@@ -1008 +1008 @@
          * negprot reply, but right now we do it. If we don't receive one,
          * we try to best guess, then fall back to NTLM.  */
-        if (!spnego_parse_negTokenInit(blob, OIDs, &principal)) {
+        if (!spnego_parse_negTokenInit(blob, OIDs, &principal) ||
+                        OIDs[0] == NULL) {
                 data_blob_free(&blob);
                 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
@@ -1873 +1874 @@
         char *p;
         int len = 4;
+        int namelen = 0;
         char *tmp;
 
@@ -1891 +1893 @@
 
         p = cli->outbuf+len;
-        memcpy(p, tmp, name_len(tmp));
-        len += name_len(tmp);
+        namelen = name_len((unsigned char *)tmp, talloc_get_size(tmp));
+        if (namelen > 0) {
+                memcpy(p, tmp, namelen);
+                len += namelen;
+        }
         TALLOC_FREE(tmp);
 
@@ -1904 +1909 @@
 
         p = cli->outbuf+len;
-        memcpy(p, tmp, name_len(tmp));
-        len += name_len(tmp);
+        namelen = name_len((unsigned char *)tmp, talloc_get_size(tmp));
+        if (namelen > 0) {
+                memcpy(p, tmp, namelen);
+                len += namelen;
+        }
         TALLOC_FREE(tmp);
 

vendor/current/source3/libsmb/clikrb5.c

@@ -29 +29 @@
 #define GSSAPI_CHECKSUM      0x8003             /* Checksum type value for Kerberos */
 #define GSSAPI_BNDLENGTH     16                 /* Bind Length (rfc-1964 pg.3) */
-#define GSSAPI_CHECKSUM_SIZE (12+GSSAPI_BNDLENGTH)
-
-#if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_FWD_TGT_CREDS) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY)
-static krb5_error_code ads_krb5_get_fwd_ticket( krb5_context context,
-                                         krb5_auth_context *auth_context,
-                                         krb5_creds *credsp,
-                                         krb5_ccache ccache,
-                                         krb5_data *authenticator);
+#define GSSAPI_CHECKSUM_SIZE (4+GSSAPI_BNDLENGTH+4) /* Length of bind length,
+                                                        bind field, flags field. */
+
+/* MIT krb5 1.7beta3 (in Ubuntu Karmic) is missing the prototype,
+   but still has the symbol */
+#if !HAVE_DECL_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE
+krb5_error_code krb5_auth_con_set_req_cksumtype(  
+        krb5_context     context,
+        krb5_auth_context      auth_context,  
+        krb5_cksumtype     cksumtype);
 #endif
 
@@ -646 +648 @@
 }
 
+/* Allocate and setup the auth context into the state we need. */
+
+static krb5_error_code setup_auth_context(krb5_context context,
+                        krb5_auth_context *auth_context)
+{
+        krb5_error_code retval;
+
+        retval = krb5_auth_con_init(context, auth_context );
+        if (retval) {
+                DEBUG(1,("krb5_auth_con_init failed (%s)\n",
+                        error_message(retval)));
+                return retval;
+        }
+
+        /* Ensure this is an addressless ticket. */
+        retval = krb5_auth_con_setaddrs(context, *auth_context, NULL, NULL);
+        if (retval) {
+                DEBUG(1,("krb5_auth_con_setaddrs failed (%s)\n",
+                        error_message(retval)));
+        }
+
+        return retval;
+}
+
+static krb5_error_code create_gss_checksum(krb5_data *in_data, /* [inout] */
+                                                uint32_t gss_flags)
+{
+        unsigned int orig_length = in_data->length;
+        unsigned int base_cksum_size = GSSAPI_CHECKSUM_SIZE;
+        char *gss_cksum = NULL;
+
+        if (orig_length) {
+                /* Extra length field for delgated ticket. */
+                base_cksum_size += 4;
+        }
+
+        if ((unsigned int)base_cksum_size + orig_length <
+                        (unsigned int)base_cksum_size) {
+                return EINVAL;
+        }
+
+        gss_cksum = (char *)SMB_MALLOC(base_cksum_size + orig_length);
+        if (gss_cksum == NULL) {
+                return ENOMEM;
+        }
+
+        memset(gss_cksum, '\0', base_cksum_size + orig_length);
+        SIVAL(gss_cksum, 0, GSSAPI_BNDLENGTH);
+
+        /* Precalculated MD5sum of NULL channel bindings (20 bytes) */
+        /* Channel bindings are: (all ints encoded as little endian)
+
+                [4 bytes] initiator_addrtype (255 for null bindings)
+                [4 bytes] initiator_address length
+                        [n bytes] .. initiator_address data - not present
+                                     in null bindings.
+                [4 bytes] acceptor_addrtype (255 for null bindings)
+                [4 bytes] acceptor_address length
+                        [n bytes] .. acceptor_address data - not present
+                                     in null bindings.
+                [4 bytes] application_data length
+                        [n bytes] .. application_ data - not present
+                                     in null bindings.
+                MD5 of this is ""\x14\x8f\x0c\xf7\xb1u\xdey*J\x9a%\xdfV\xc5\x18"
+        */
+
+        memcpy(&gss_cksum[4],
+                "\x14\x8f\x0c\xf7\xb1u\xdey*J\x9a%\xdfV\xc5\x18",
+                GSSAPI_BNDLENGTH);
+
+        SIVAL(gss_cksum, 20, gss_flags);
+
+        if (orig_length) {
+                SSVAL(gss_cksum, 24, 1); /* The Delegation Option identifier */
+                SSVAL(gss_cksum, 26, orig_length);
+                /* Copy the kerberos KRB_CRED data */
+                memcpy(gss_cksum + 28, in_data->data, orig_length);
+                free(in_data->data);
+                in_data->data = NULL;
+                in_data->length = 0;
+        }
+        in_data->data = gss_cksum;
+        in_data->length = base_cksum_size + orig_length;
+        return 0;
+}
+
 /*
   we can't use krb5_mk_req because w2k wants the service to be in a particular format
@@ -666 +754 @@
         bool creds_ready = False;
         int i = 0, maxtries = 3;
-        
+        uint32_t gss_flags = 0;
+
         ZERO_STRUCT(in_data);
 
@@ -736 +825 @@
         }
 
-#if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_FWD_TGT_CREDS) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY)
+        /* Allocate the auth_context. */
+        retval = setup_auth_context(context, auth_context);
+        if (retval) {
+                DEBUG(1,("setup_auth_context failed (%s)\n",
+                        error_message(retval)));
+                goto cleanup_creds;
+        }
+
+#if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_FWD_TGT_CREDS) && defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY)
         if( credsp->ticket_flags & TKT_FLG_OK_AS_DELEGATE ) {
                 /* Fetch a forwarded TGT from the KDC so that we can hand off a 2nd ticket
@@ -743 +840 @@
                 DEBUG( 3, ("ads_krb5_mk_req: server marked as OK to delegate to, building forwardable TGT\n")  );
 
-                if( *auth_context == NULL ) {
-                        /* Allocate if it has not yet been allocated. */
-                        retval = krb5_auth_con_init( context, auth_context );
-                        if (retval) {
-                                DEBUG(1,("ads_krb5_mk_req: krb5_auth_con_init failed (%s)\n",
-                                        error_message(retval)));
-                                goto cleanup_creds;
-                        }
-                }
-
-                retval = krb5_auth_con_setuseruserkey( context, *auth_context, &credsp->keyblock );
+                retval = krb5_auth_con_setuseruserkey(context,
+                                        *auth_context,
+                                        &credsp->keyblock );
                 if (retval) {
-                        DEBUG(1,("ads_krb5_mk_req: krb5_auth_con_setuseruserkey failed (%s)\n",
+                        DEBUG(1,("krb5_auth_con_setuseruserkey failed (%s)\n",
                                 error_message(retval)));
                         goto cleanup_creds;
@@ -761 +850 @@
 
                 /* Must use a subkey for forwarded tickets. */
-                retval = krb5_auth_con_setflags( context, *auth_context, KRB5_AUTH_CONTEXT_USE_SUBKEY);
+                retval = krb5_auth_con_setflags(context,
+                                *auth_context,
+                                KRB5_AUTH_CONTEXT_USE_SUBKEY);
                 if (retval) {
-                        DEBUG(1,("ads_krb5_mk_req: krb5_auth_con_setflags failed (%s)\n",
+                        DEBUG(1,("krb5_auth_con_setflags failed (%s)\n",
                                 error_message(retval)));
                         goto cleanup_creds;
                 }
 
-                retval = ads_krb5_get_fwd_ticket( context,
-                                                auth_context,
-                                                credsp,
-                                                ccache,
-                                                &in_data );
+                retval = krb5_fwd_tgt_creds(context,/* Krb5 context [in] */
+                                *auth_context,  /* Authentication context [in] */
+                                CONST_DISCARD(char *, KRB5_TGS_NAME),  /* Ticket service name ("krbtgt") [in] */
+                                credsp->client, /* Client principal for the tgt [in] */
+                                credsp->server, /* Server principal for the tgt [in] */
+                                ccache,         /* Credential cache to use for storage [in] */
+                                1,              /* Turn on for "Forwardable ticket" [in] */
+                                &in_data );     /* Resulting response [out] */
+
                 if (retval) {
-                        DEBUG( 3, ("ads_krb5_get_fwd_ticket failed (%s)\n",
+                        DEBUG( 3, ("krb5_fwd_tgt_creds failed (%s)\n",
                                    error_message( retval ) ) );
 
@@ -789 +884 @@
                         krb5_auth_con_free(context, *auth_context);
                         *auth_context = NULL;
-                }
+                        retval = setup_auth_context(context, auth_context);
+                        if (retval) {
+                                DEBUG(1,("setup_auth_context failed (%s)\n",
+                                        error_message(retval)));
+                                goto cleanup_creds;
+                        }
+                } else {
+                        /* We got a delegated ticket. */
+                        gss_flags |= GSS_C_DELEG_FLAG;
+                }
+        }
+#endif
+
+        /* Frees and reallocates in_data into a GSS checksum blob. */
+        retval = create_gss_checksum(&in_data, gss_flags);
+        if (retval) {
+                goto cleanup_data;
+        }
+
+#if defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE)
+        /* We always want GSS-checksum types. */
+        retval = krb5_auth_con_set_req_cksumtype(context, *auth_context, GSSAPI_CHECKSUM );
+        if (retval) {
+                DEBUG(1,("krb5_auth_con_set_req_cksumtype failed (%s)\n",
+                        error_message(retval)));
+                goto cleanup_data;
         }
 #endif
@@ -800 +920 @@
         }
 
+cleanup_data:
         if (in_data.data) {
                 free( in_data.data );
@@ -1846 +1967 @@
         return ret;
 }
-
-#if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_FWD_TGT_CREDS) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY)
-/**************************************************************
-Routine: ads_krb5_get_fwd_ticket
- Description:
-    When a service ticket is flagged as trusted
-    for delegation we should provide a forwardable
-    ticket so that the remote host can act on our
-    behalf.  This is done by taking the 2nd forwardable
-    TGT and storing it in the GSS-API authenticator
-    "checksum".  This routine will populate
-    the krb5_data authenticator with this TGT.
- Parameters:
-    krb5_context context: The kerberos context for this authentication.
-    krb5_auth_context:    The authentication context.
-    krb5_creds *credsp:   The ticket credentials (AS-REP).
-    krb5_ccache ccache:   The credentials cache.
-    krb5_data &authenticator: The checksum field that will store the TGT, and
-     authenticator.data must be freed by the caller.
-
- Returns:
-    krb5_error_code: 0 if no errors, otherwise set.
-**************************************************************/
-
-static krb5_error_code ads_krb5_get_fwd_ticket( krb5_context context,
-                                         krb5_auth_context *auth_context,
-                                         krb5_creds *credsp,
-                                         krb5_ccache ccache,
-                                         krb5_data *authenticator)
-{
-        krb5_data fwdData;
-        krb5_error_code retval = 0;
-        char *pChksum = NULL;
-        char *p = NULL;
-
-/* MIT krb5 1.7beta3 (in Ubuntu Karmic) is missing the prototype,
-   but still has the symbol */
-#if !HAVE_DECL_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE
-krb5_error_code krb5_auth_con_set_req_cksumtype(  
-        krb5_context     context,
-        krb5_auth_context      auth_context,  
-        krb5_cksumtype     cksumtype);
-#endif
-
-        ZERO_STRUCT(fwdData);
-        ZERO_STRUCTP(authenticator);
-
-        retval = krb5_fwd_tgt_creds(context,/* Krb5 context [in] */
-                                *auth_context,  /* Authentication context [in] */
-                                CONST_DISCARD(char *, KRB5_TGS_NAME),  /* Ticket service name ("krbtgt") [in] */
-                                credsp->client, /* Client principal for the tgt [in] */
-                                credsp->server, /* Server principal for the tgt [in] */
-                                ccache,         /* Credential cache to use for storage [in] */
-                                1,              /* Turn on for "Forwardable ticket" [in] */
-                                &fwdData );     /* Resulting response [out] */
-
-
-        if (retval) {
-                DEBUG(1,("ads_krb5_get_fwd_ticket: krb5_fwd_tgt_creds failed (%s)\n", 
-                        error_message(retval)));
-                goto out;
-        }
-
-        if ((unsigned int)GSSAPI_CHECKSUM_SIZE + (unsigned int)fwdData.length <
-                (unsigned int)GSSAPI_CHECKSUM_SIZE) {
-                retval = EINVAL;
-                goto out;
-        }
-
-        /* We're going to allocate a gssChecksum structure with a little
-           extra data the length of the kerberos credentials length
-           (APPLICATION 22) so that we can pack it on the end of the structure.
-        */
-
-        pChksum = (char *)SMB_MALLOC(GSSAPI_CHECKSUM_SIZE + fwdData.length );
-        if (!pChksum) {
-                retval = ENOMEM;
-                goto out;
-        }
-
-        p = pChksum;
-
-        SIVAL(p, 0, GSSAPI_BNDLENGTH);
-        p += 4;
-
-        /* Zero out the bindings fields */
-        memset(p, '\0', GSSAPI_BNDLENGTH );
-        p += GSSAPI_BNDLENGTH;
-
-        SIVAL(p, 0, GSS_C_DELEG_FLAG );
-        p += 4;
-        SSVAL(p, 0, 1 );
-        p += 2;
-        SSVAL(p, 0, fwdData.length );
-        p += 2;
-
-        /* Migrate the kerberos KRB_CRED data to the checksum delegation */
-        memcpy(p, fwdData.data, fwdData.length );
-        p += fwdData.length;
-
-        /* We need to do this in order to allow our GSS-API  */
-        retval = krb5_auth_con_set_req_cksumtype( context, *auth_context, GSSAPI_CHECKSUM );
-        if (retval) {
-                goto out;
-        }
-
-        /* We now have a service ticket, now turn it into an AP-REQ. */
-        authenticator->length = fwdData.length + GSSAPI_CHECKSUM_SIZE;
-
-        /* Caller should call free() when they're done with this. */
-        authenticator->data = (char *)pChksum;
-
-  out:
-
-        /* Remove that input data, we never needed it anyway. */
-        if (fwdData.length > 0) {
-                krb5_free_data_contents( context, &fwdData );
-        }
-
-        return retval;
-}
-#endif
 
 #if defined(HAVE_KRB5_GET_CREDS_OPT_SET_IMPERSONATE) && \

vendor/current/source3/libsmb/climessage.c

@@ -64 +64 @@
         *p++ = 4;
         memcpy(p, utmp, ulen);
+        p += ulen;
         *p++ = 4;
         memcpy(p, htmp, hlen);
+        p += hlen;
         TALLOC_FREE(htmp);
         TALLOC_FREE(utmp);
@@ -164 +166 @@
                 return tevent_req_post(req, ev);
         }
-        SCVAL(bytes, 0, 0);     /* pad */
-        SSVAL(bytes, 1, msglen);
+        SCVAL(bytes, 0, 1);     /* pad */
+        SSVAL(bytes+1, 0, msglen);
         memcpy(bytes+3, msg, msglen);
         TALLOC_FREE(tmp);

vendor/current/source3/libsmb/clispnego.c

@@ -5 +5 @@
    Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
    Copyright (C) Luke Howard     2003
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -147 +147 @@
 
         asn1_check_OID(data,OID_SPNEGO);
+
+        /* negTokenInit  [0]  NegTokenInit */
         asn1_start_tag(data,ASN1_CONTEXT(0));
         asn1_start_tag(data,ASN1_SEQUENCE(0));
+
+        /* mechTypes [0] MechTypeList  OPTIONAL */
+
+        /* Not really optional, we depend on this to decide
+         * what mechanisms we have to work with. */
 
         asn1_start_tag(data,ASN1_CONTEXT(0));
@@ -162 +169 @@
 
         *principal = NULL;
-        if (asn1_tag_remaining(data) > 0) {
+
+        /*
+          Win7 + Live Sign-in Assistant attaches a mechToken
+          ASN1_CONTEXT(2) to the negTokenInit packet
+          which breaks our negotiation if we just assume
+          the next tag is ASN1_CONTEXT(3).
+        */
+
+        if (asn1_peek_tag(data, ASN1_CONTEXT(1))) {
+                uint8 flags;
+
+                /* reqFlags [1] ContextFlags  OPTIONAL */
+                asn1_start_tag(data, ASN1_CONTEXT(1));
+                asn1_start_tag(data, ASN1_BIT_STRING);
+                while (asn1_tag_remaining(data) > 0) {
+                        asn1_read_uint8(data, &flags);
+                }
+                asn1_end_tag(data);
+                asn1_end_tag(data);
+        }
+
+        if (asn1_peek_tag(data, ASN1_CONTEXT(2))) {
+                /* mechToken [2] OCTET STRING  OPTIONAL */
+                DATA_BLOB token;
+                asn1_start_tag(data, ASN1_CONTEXT(2));
+                asn1_read_OctetString(data, talloc_autofree_context(),
+                        &token);
+                asn1_end_tag(data);
+                /* Throw away the token - not used. */
+                data_blob_free(&token);
+        }
+
+        if (asn1_peek_tag(data, ASN1_CONTEXT(3))) {
+                /* mechListMIC [3] OCTET STRING  OPTIONAL */
                 asn1_start_tag(data, ASN1_CONTEXT(3));
                 asn1_start_tag(data, ASN1_SEQUENCE(0));
                 asn1_start_tag(data, ASN1_CONTEXT(0));
-                asn1_read_GeneralString(data,talloc_autofree_context(),principal);
+                asn1_read_GeneralString(data,talloc_autofree_context(),
+                        principal);
                 asn1_end_tag(data);
                 asn1_end_tag(data);

vendor/current/source3/libsmb/nmblib.c

@@ -1238 +1238 @@
 /****************************************************************************
  Interpret the weird netbios "name" into a unix fstring. Return the name type.
+ Returns -1 on error.
 ****************************************************************************/
 
-static int name_interpret(char *in, fstring name)
-{
+static int name_interpret(unsigned char *buf, size_t buf_len,
+                unsigned char *in, fstring name)
+{
+        unsigned char *end_ptr = buf + buf_len;
         int ret;
-        int len = (*in++) / 2;
+        unsigned int len;
         fstring out_string;
-        char *out = out_string;
+        unsigned char *out = (unsigned char *)out_string;
 
         *out=0;
 
-        if (len > 30 || len<1)
-                return(0);
+        if (in >= end_ptr) {
+                return -1;
+        }
+        len = (*in++) / 2;
+
+        if (len<1) {
+                return -1;
+        }
 
         while (len--) {
+                if (&in[1] >= end_ptr) {
+                        return -1;
+                }
                 if (in[0] < 'A' || in[0] > 'P' || in[1] < 'A' || in[1] > 'P') {
                         *out = 0;
@@ -1260 +1272 @@
                 in += 2;
                 out++;
+                if (PTR_DIFF(out,out_string) >= sizeof(fstring)) {
+                        return -1;
+                }
         }
         ret = out[-1];
         out[-1] = 0;
 
-#ifdef NETBIOS_SCOPE
-        /* Handle any scope names */
-        while(*in) {
-                *out++ = '.'; /* Scope names are separated by periods */
-                len = *(unsigned char *)in++;
-                StrnCpy(out, in, len);
-                out += len;
-                *out=0;
-                in += len;
-        }
-#endif
         pull_ascii_fstring(name, out_string);
 
@@ -1353 +1357 @@
 ****************************************************************************/
 
-static char *name_ptr(char *buf,int ofs)
-{
-        unsigned char c = *(unsigned char *)(buf+ofs);
-
+static unsigned char *name_ptr(unsigned char *buf, size_t buf_len, unsigned int ofs)
+{
+        unsigned char c = 0;
+
+        if (ofs > buf_len || buf_len < 1) {
+                return NULL;
+        }
+
+        c = *(unsigned char *)(buf+ofs);
         if ((c & 0xC0) == 0xC0) {
-                uint16 l = RSVAL(buf, ofs) & 0x3FFF;
+                uint16 l = 0;
+
+                if (ofs > buf_len - 1) {
+                        return NULL;
+                }
+                l = RSVAL(buf, ofs) & 0x3FFF;
+                if (l > buf_len) {
+                        return NULL;
+                }
                 DEBUG(5,("name ptr to pos %d from %d is %s\n",l,ofs,buf+l));
                 return(buf + l);
@@ -1368 +1385 @@
 /****************************************************************************
  Extract a netbios name from a buf (into a unix string) return name type.
+ Returns -1 on error.
 ****************************************************************************/
 
-int name_extract(char *buf,int ofs, fstring name)
-{
-        char *p = name_ptr(buf,ofs);
-        int d = PTR_DIFF(p,buf+ofs);
+int name_extract(unsigned char *buf, size_t buf_len, unsigned int ofs, fstring name)
+{
+        unsigned char *p = name_ptr(buf,buf_len,ofs);
 
         name[0] = '\0';
-        if (d < -50 || d > 50)
-                return(0);
-        return(name_interpret(p,name));
+        if (p == NULL) {
+                return -1;
+        }
+        return(name_interpret(buf,buf_len,p,name));
 }
 
 /****************************************************************************
  Return the total storage length of a mangled name.
+ Returns -1 on error.
 ****************************************************************************/
 
-int name_len(char *s1)
+int name_len(unsigned char *s1, size_t buf_len)
 {
         /* NOTE: this argument _must_ be unsigned */
         unsigned char *s = (unsigned char *)s1;
-        int len;
-
+        int len = 0;
+
+        if (buf_len < 1) {
+                return -1;
+        }
         /* If the two high bits of the byte are set, return 2. */
-        if (0xC0 == (*s & 0xC0))
+        if (0xC0 == (*s & 0xC0)) {
+                if (buf_len < 2) {
+                        return -1;
+                }
                 return(2);
+        }
 
         /* Add up the length bytes. */
         for (len = 1; (*s); s += (*s) + 1) {
                 len += *s + 1;
-                SMB_ASSERT(len < 80);
+                if (len > buf_len) {
+                        return -1;
+                }
         }