From: Stefan Metzmacher <metze@samba.org>
Date: Fri, 19 Jun 2015 20:35:44 +0000 (+0200)
Subject: s4:librpc/rpc: let dcerpc_ship_next_request() use a sig_size for a padded payload
X-Git-Tag: samba-4.1.20~28
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=18342a7cbb14c7fe2f451a3e1386deaf819f6f7a;p=thirdparty%2Fsamba.git

s4:librpc/rpc: let dcerpc_ship_next_request() use a sig_size for a padded payload

The sig_size could differ depending on the aligment/padding.
So should use the same alignment as we use for the payload.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit fc249d542fcb8d043ae72eb7963d3a85eb79253a)
---

diff --git a/source4/librpc/rpc/dcerpc.c b/source4/librpc/rpc/dcerpc.c
index cd33dc04087..9600822791f 100644
--- a/source4/librpc/rpc/dcerpc.c
+++ b/source4/librpc/rpc/dcerpc.c
@@ -1594,8 +1594,13 @@ static void dcerpc_ship_next_request(struct dcecli_connection *c)
 	chunk_size -= DCERPC_REQUEST_LENGTH;
 	if (c->security_state.auth_info &&
 	    c->security_state.generic_state) {
+		size_t max_payload = chunk_size;
+
+		max_payload -= DCERPC_AUTH_TRAILER_LENGTH;
+		max_payload -= (max_payload % DCERPC_AUTH_PAD_ALIGNMENT);
+
 		sig_size = gensec_sig_size(c->security_state.generic_state,
-					   p->conn->srv_max_recv_frag);
+					   max_payload);
 		if (sig_size) {
 			chunk_size -= DCERPC_AUTH_TRAILER_LENGTH;
 			chunk_size -= sig_size;