Changeset 693 for branches/samba-3.0/source/smbd/process.c

Timestamp:

Mar 11, 2012, 6:19:02 PM (13 years ago)

Author:

Herwig Bauernfeind

Message:

Update Samba 3.0 with CVE-2012-0870 security patch

File:

• branches/samba-3.0/source/smbd/process.c (modified) (4 diffs)

branches/samba-3.0/source/smbd/process.c

@@ -1026 +1026 @@
         int msg_type = CVAL(inbuf,0);
         uint16_t mid = SVAL(inbuf, smb_mid);
+        uint8_t wct = CVAL(inbuf, smb_wct);
 
         chain_size = 0;
@@ -1033 +1034 @@
         if (msg_type != 0)
                 return(reply_special(inbuf,outbuf));  
+
+        /* Ensure we have at least wct words and 2 bytes of bcc. */
+        if (smb_size + wct*2 > size) {
+                DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
+                        (unsigned int)wct,
+                        (unsigned int)size));
+                exit_server_cleanly("Invalid SMB request");
+        }
+        /* Ensure bcc is correct. */
+        if (((uint8 *)smb_buf(inbuf)) + smb_buflen(inbuf) > inbuf + size) {
+                DEBUG(0,("init_smb_request: invalid bcc number %u "
+                        "(wct = %u, size %u)\n",
+                        (unsigned int)smb_buflen(inbuf),
+                        (unsigned int)wct,
+                        (unsigned int)size));
+                exit_server_cleanly("Invalid SMB request");
+        }
 
         construct_reply_common(inbuf, outbuf);
@@ -1162 +1180 @@
         static int orig_size;
         int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
-        unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
+        static unsigned smb_off2;
         char *inbuf2, *outbuf2;
         int outsize2;
@@ -1181 +1199 @@
                 orig_outbuf = outbuf;
                 orig_size = size;
-        }
+                smb_off2 = 0;
+        }
+
+        if (SVAL(inbuf,smb_vwv1) <= smb_off2) {
+                DEBUG(1, ("AndX offset not increasing\n"));
+                SCVAL(outbuf, smb_vwv0, 0xFF);
+                return outsize;
+        }
+        smb_off2 = SVAL(inbuf, smb_vwv1);
 
         /* Validate smb_off2 */