CVE-2015-5370: s4:rpc_server: add some padding to dcesrv_bind_nak() responses

This matches Windows 2012R2.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11344

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>

diff --git a/source4/rpc_server/dcerpc_server.c b/source4/rpc_server/dcerpc_server.c
index 6df9f77bb1178417c45f5560e2e5e705c19e78d0..c0b770e6d78208de0dd22cc6301f24c7a5aaf43a 100644 (file)
--- a/source4/rpc_server/dcerpc_server.c
+++ b/source4/rpc_server/dcerpc_server.c
@@ -462,6 +462,7 @@ static NTSTATUS dcesrv_bind_nak(struct dcesrv_call_state *call, uint32_t reason)
        struct dcerpc_bind_nak_version version;
        struct data_blob_list_item *rep;
        NTSTATUS status;
+       static const uint8_t _pad[3] = { 0, };
 
        /* setup a bind_nak */
        dcesrv_init_hdr(&pkt, lpcfg_rpc_big_endian(call->conn->dce_ctx->lp_ctx));
@@ -474,7 +475,7 @@ static NTSTATUS dcesrv_bind_nak(struct dcesrv_call_state *call, uint32_t reason)
        version.rpc_vers_minor = 0;
        pkt.u.bind_nak.num_versions = 1;
        pkt.u.bind_nak.versions = &version;
-       pkt.u.bind_nak._pad = data_blob_null;
+       pkt.u.bind_nak._pad = data_blob_const(_pad, sizeof(_pad));
 
        rep = talloc_zero(call, struct data_blob_list_item);
        if (!rep) {