From 3e6e9e3acd17531148457be59a32727fb87ae43d Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 19 Jun 2015 16:55:39 +0200 Subject: [PATCH] s3:librpc/rpc: allow up to DCERPC_AUTH_PAD_ALIGNMENT padding bytes in dcerpc_add_auth_footer() BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061 Signed-off-by: Stefan Metzmacher Reviewed-by: Jeremy Allison Reviewed-by: Andreas Schneider Reviewed-by: Andrew Bartlett --- source3/librpc/rpc/dcerpc_helpers.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/source3/librpc/rpc/dcerpc_helpers.c b/source3/librpc/rpc/dcerpc_helpers.c index a9b24c8ec4d..5f2b94cadfe 100644 --- a/source3/librpc/rpc/dcerpc_helpers.c +++ b/source3/librpc/rpc/dcerpc_helpers.c @@ -422,7 +422,7 @@ NTSTATUS dcerpc_add_auth_footer(struct pipe_auth_data *auth, size_t pad_len, DATA_BLOB *rpc_out) { struct gensec_security *gensec_security; - char pad[CLIENT_NDR_PADDING_SIZE] = { 0, }; + const char pad[DCERPC_AUTH_PAD_ALIGNMENT] = { 0, }; DATA_BLOB auth_info; DATA_BLOB auth_blob; NTSTATUS status; @@ -432,6 +432,8 @@ NTSTATUS dcerpc_add_auth_footer(struct pipe_auth_data *auth, } if (pad_len) { + SMB_ASSERT(pad_len <= ARRAY_SIZE(pad)); + /* Copy the sign/seal padding data. */ if (!data_blob_append(NULL, rpc_out, pad, pad_len)) { return NT_STATUS_NO_MEMORY; -- 2.47.3