From 39a3d728a605b02d209b39ee764de5bd4d4501fc Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Sat, 2 May 2020 14:59:07 +0200 Subject: [PATCH] libsmb: Protect cli_RNetShareEnum() against rprcnt<6 Bug: https://bugzilla.samba.org/show_bug.cgi?id=14366 Signed-off-by: Volker Lendecke Reviewed-by: Andreas Schneider (cherry picked from commit 4a9fe4efefa67d6f24efcbe29722a43fc4859fdc) --- source3/libsmb/clirap.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/source3/libsmb/clirap.c b/source3/libsmb/clirap.c index a703f453556..9b7f54c503b 100644 --- a/source3/libsmb/clirap.c +++ b/source3/libsmb/clirap.c @@ -204,6 +204,11 @@ int cli_RNetShareEnum(struct cli_state *cli, void (*fn)(const char *, uint32_t, goto done; } + if (rprcnt < 6) { + DBG_ERR("Got invalid result: rprcnt=%u\n", rprcnt); + goto done; + } + res = rparam? SVAL(rparam,0) : -1; if (res == 0 || res == ERRmoredata) { -- 2.47.2