From: Volker Lendecke <vl@samba.org>
Date: Sat, 2 May 2020 12:59:07 +0000 (+0200)
Subject: libsmb: Protect cli_RNetShareEnum() against rprcnt<6
X-Git-Tag: ldb-2.2.0~730
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4a9fe4efefa67d6f24efcbe29722a43fc4859fdc;p=thirdparty%2Fsamba.git

libsmb: Protect cli_RNetShareEnum() against rprcnt<6

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14362
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
---

diff --git a/source3/libsmb/clirap.c b/source3/libsmb/clirap.c
index f1e7f2488a5..1b4734ae919 100644
--- a/source3/libsmb/clirap.c
+++ b/source3/libsmb/clirap.c
@@ -137,6 +137,11 @@ int cli_RNetShareEnum(struct cli_state *cli, void (*fn)(const char *, uint32_t,
 		goto done;
 	}
 
+	if (rprcnt < 6) {
+		DBG_ERR("Got invalid result: rprcnt=%u\n", rprcnt);
+		goto done;
+	}
+
 	res = rparam? SVAL(rparam,0) : -1;
 
 	if (res == 0 || res == ERRmoredata) {