code.vuplus.com Git - vuplus_openvuplus/blob - meta-openvuplus/recipes-connectivity/samba/samba-3.0.37/samba-3.0.37-CVE-2012-1182.patch

   1 From e11637c2c89c2d38963311416c34a4767b19e175 Mon Sep 17 00:00:00 2001
   2 From: Stefan Metzmacher <metze@samba.org>
   3 Date: Sat, 17 Mar 2012 01:22:27 +0100
   4 Subject: [PATCH] s3:librpc/gen_ndr: fix array checks (bug #8815 / CVE-2012-1182)
   5
   6 An Anonymous researcher working with HP's Zero Day Initiative program
   7 has found this and notified us.
   8
   9 metze
  10 ---
  11  source/librpc/gen_ndr/ndr_wkssvc.c |   12 ++++++------
  12  1 files changed, 6 insertions(+), 6 deletions(-)
  13
  14 diff --git source/librpc/gen_ndr/ndr_wkssvc.c source/librpc/gen_ndr/ndr_wkssvc.c
  15 index 2af3587..07cf1a1 100644
  16 --- source/librpc/gen_ndr/ndr_wkssvc.c
  17 +++ source/librpc/gen_ndr/ndr_wkssvc.c
  18 @@ -1385,10 +1385,10 @@ NTSTATUS ndr_pull_USER_INFO_0_CONTAINER(struct ndr_pull *ndr, int ndr_flags, str
  19                         NDR_PULL_ALLOC_N(ndr, r->user0, ndr_get_array_size(ndr, &r->user0));
  20                         _mem_save_user0_1 = NDR_PULL_GET_MEM_CTX(ndr);
  21                         NDR_PULL_SET_MEM_CTX(ndr, r->user0, 0);
  22 -                       for (cntr_user0_1 = 0; cntr_user0_1 < r->entries_read; cntr_user0_1++) {
  23 +                       for (cntr_user0_1 = 0; cntr_user0_1 < ndr_get_array_size(ndr, &r->user0); cntr_user0_1++) {
  24                                 NDR_CHECK(ndr_pull_USER_INFO_0(ndr, NDR_SCALARS, &r->user0[cntr_user0_1]));
  25                         }
  26 -                       for (cntr_user0_1 = 0; cntr_user0_1 < r->entries_read; cntr_user0_1++) {
  27 +                       for (cntr_user0_1 = 0; cntr_user0_1 < ndr_get_array_size(ndr, &r->user0); cntr_user0_1++) {
  28                                 NDR_CHECK(ndr_pull_USER_INFO_0(ndr, NDR_BUFFERS, &r->user0[cntr_user0_1]));
  29                         }
  30                         NDR_PULL_SET_MEM_CTX(ndr, _mem_save_user0_1, 0);
  31 @@ -1631,10 +1631,10 @@ NTSTATUS ndr_pull_USER_INFO_1_CONTAINER(struct ndr_pull *ndr, int ndr_flags, str
  32                         NDR_PULL_ALLOC_N(ndr, r->user1, ndr_get_array_size(ndr, &r->user1));
  33                         _mem_save_user1_1 = NDR_PULL_GET_MEM_CTX(ndr);
  34                         NDR_PULL_SET_MEM_CTX(ndr, r->user1, 0);
  35 -                       for (cntr_user1_1 = 0; cntr_user1_1 < r->entries_read; cntr_user1_1++) {
  36 +                       for (cntr_user1_1 = 0; cntr_user1_1 < ndr_get_array_size(ndr, &r->user1); cntr_user1_1++) {
  37                                 NDR_CHECK(ndr_pull_USER_INFO_1(ndr, NDR_SCALARS, &r->user1[cntr_user1_1]));
  38                         }
  39 -                       for (cntr_user1_1 = 0; cntr_user1_1 < r->entries_read; cntr_user1_1++) {
  40 +                       for (cntr_user1_1 = 0; cntr_user1_1 < ndr_get_array_size(ndr, &r->user1); cntr_user1_1++) {
  41                                 NDR_CHECK(ndr_pull_USER_INFO_1(ndr, NDR_BUFFERS, &r->user1[cntr_user1_1]));
  42                         }
  43                         NDR_PULL_SET_MEM_CTX(ndr, _mem_save_user1_1, 0);
  44 @@ -1953,10 +1953,10 @@ NTSTATUS ndr_pull_wkssvc_NetWkstaTransportCtr0(struct ndr_pull *ndr, int ndr_fla
  45                         NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
  46                         _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
  47                         NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
  48 -                       for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
  49 +                       for (cntr_array_1 = 0; cntr_array_1 < ndr_get_array_size(ndr, &r->array); cntr_array_1++) {
  50                                 NDR_CHECK(ndr_pull_wkssvc_NetWkstaTransportInfo0(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
  51                         }
  52 -                       for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
  53 +                       for (cntr_array_1 = 0; cntr_array_1 < ndr_get_array_size(ndr, &r->array); cntr_array_1++) {
  54                                 NDR_CHECK(ndr_pull_wkssvc_NetWkstaTransportInfo0(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
  55                         }
  56                         NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
  57 --
  58 1.7.4.1
  59