← Back to branch summary

~ubuntu-branches/ubuntu/oneiric/samba/oneiric-security

« back to all changes in this revision

Viewing changes to librpc/gen_ndr/ndr_misc.c

  • Committer: Package Import Robot
  • Author(s): Tyler Hicks
  • Date: 2012-04-12 05:28:44 UTC
  • mfrom: (147.1.1 oneiric-proposed)
  • Revision ID: package-import@ubuntu.com-20120412052844-348q6l4dcb303sdu
Tags: 2:3.5.11~dfsg-1ubuntu2.2
https://launchpad.net/bugs/978458
* SECURITY UPDATE: Unauthenticated remote code execution via
  RPC calls (LP: #978458)
  - debian/patches/CVE-2012-1182-1.patch: Fix PIDL compiler to generate code
    that uses the same value for array allocation and array length checks.
    Based on upstream patch.
  - debian/patches/CVE-2012-1182-2.patch: Regenerate PIDL generated files with
    the patched PIDL compiler
  - CVE-2012-1182

Show diffs side-by-side

added added

removed removed

Lines of Context:
librpc/gen_ndr/ndr_misc.c
21
21
 
22
22
_PUBLIC_ enum ndr_err_code ndr_pull_GUID(struct ndr_pull *ndr, int ndr_flags, struct GUID *r)
23
23
{
 
24
        uint32_t size_clock_seq_0 = 0;
 
25
        uint32_t size_node_0 = 0;
24
26
        if (ndr_flags & NDR_SCALARS) {
25
27
                NDR_CHECK(ndr_pull_align(ndr, 4));
26
28
                NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->time_low));
27
29
                NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->time_mid));
28
30
                NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->time_hi_and_version));
29
 
                NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->clock_seq, 2));
30
 
                NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->node, 6));
 
31
                size_clock_seq_0 = 2;
 
32
                NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->clock_seq, size_clock_seq_0));
 
33
                size_node_0 = 6;
 
34
                NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->node, size_node_0));
31
35
                NDR_CHECK(ndr_pull_trailer_align(ndr, 4));
32
36
        }
33
37
        if (ndr_flags & NDR_BUFFERS) {