librpc/rpc: let dcerpc_read_ncacn_packet_next_vector() handle fragments without any...

DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED don't have any payload by
default. In order to receive them via dcerpc_read_ncacn_packet_send/recv
we need to allow fragments with frag_len == DCERPC_NCACN_PAYLOAD_OFFSET.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15446

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

diff --git a/librpc/rpc/dcerpc_util.c b/librpc/rpc/dcerpc_util.c
index 0ecb2bff1fa86eb66537cb991b09d645f6ed5f88..a3a734b0c090e64401d0309a005e21c3ff4fe4c5 100644 (file)
--- a/librpc/rpc/dcerpc_util.c
+++ b/librpc/rpc/dcerpc_util.c
@@ -565,9 +565,14 @@ static int dcerpc_read_ncacn_packet_next_vector(struct tstream_context *stream,
 
                ofs = state->buffer.length;
 
-               if (frag_len < ofs) {
+               if (frag_len <= ofs) {
                        /*
-                        * something is wrong, let the caller deal with it
+                        * With frag_len == ofs, we are done, this is likely
+                        * a DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED
+                        * without any payload.
+                        *
+                        * Otherwise it's a broken packet and we
+                        * let the caller deal with it.
                         */
                        *_vector = NULL;
                        *_count = 0;