From: Günther Deschner <gd@samba.org>
Date: Mon, 25 Sep 2023 18:31:24 +0000 (+0200)
Subject: s3-iremotewinspool: check for correct object_uuid in dispatch fn.
X-Git-Tag: tevent-0.16.0~32
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e05c83408f7e39c5359865394b629579abbeb4b4;p=thirdparty%2Fsamba.git

s3-iremotewinspool: check for correct object_uuid in dispatch fn.

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
---

diff --git a/source3/rpc_server/spoolss/srv_iremotewinspool.c b/source3/rpc_server/spoolss/srv_iremotewinspool.c
index fb60dfef822..5bc4228f83f 100644
--- a/source3/rpc_server/spoolss/srv_iremotewinspool.c
+++ b/source3/rpc_server/spoolss/srv_iremotewinspool.c
@@ -91,6 +91,25 @@ static NTSTATUS iremotewinspool__op_dispatch_internal(struct dcesrv_call_state *
 	struct pipes_struct *p = NULL;
 	NTSTATUS status = NT_STATUS_OK;
 	bool impersonated = false;
+	bool ok;
+	struct GUID object_uuid;
+
+	ok = dce_call->pkt.pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID;
+	if (!ok) {
+		dce_call->fault_code = DCERPC_NCA_S_UNSUPPORTED_TYPE;
+		return NT_STATUS_NET_WRITE_FAULT;
+	}
+
+	status = GUID_from_string(IREMOTEWINSPOOL_OBJECT_GUID, &object_uuid);
+	if (!NT_STATUS_IS_OK(status)) {
+		dce_call->fault_code = DCERPC_NCA_S_UNSUPPORTED_TYPE;
+		return NT_STATUS_NET_WRITE_FAULT;
+	}
+
+	if (!GUID_equal(&dce_call->pkt.u.request.object.object, &object_uuid)) {
+		dce_call->fault_code = DCERPC_NCA_S_UNSUPPORTED_TYPE;
+		return NT_STATUS_NET_WRITE_FAULT;
+	}
 
 	if (forward_opnum_to_spoolss(opnum)) {
 		return spoolss__op_dispatch(dce_call, mem_ctx, r);