← Back to branch summary

~ubuntu-branches/ubuntu/oneiric/samba/oneiric-security

« back to all changes in this revision

Viewing changes to source3/librpc/gen_ndr/ndr_secrets.c

  • Committer: Package Import Robot
  • Author(s): Tyler Hicks
  • Date: 2012-04-12 05:28:44 UTC
  • mfrom: (147.1.1 oneiric-proposed)
  • Revision ID: package-import@ubuntu.com-20120412052844-348q6l4dcb303sdu
Tags: 2:3.5.11~dfsg-1ubuntu2.2
https://launchpad.net/bugs/978458
* SECURITY UPDATE: Unauthenticated remote code execution via
  RPC calls (LP: #978458)
  - debian/patches/CVE-2012-1182-1.patch: Fix PIDL compiler to generate code
    that uses the same value for array allocation and array length checks.
    Based on upstream patch.
  - debian/patches/CVE-2012-1182-2.patch: Regenerate PIDL generated files with
    the patched PIDL compiler
  - CVE-2012-1182

Show diffs side-by-side

added added

removed removed

Lines of Context:
source3/librpc/gen_ndr/ndr_secrets.c
32
32
 
33
33
_PUBLIC_ enum ndr_err_code ndr_pull_TRUSTED_DOM_PASS(struct ndr_pull *ndr, int ndr_flags, struct TRUSTED_DOM_PASS *r)
34
34
{
 
35
        uint32_t size_uni_name_0 = 0;
35
36
        {
36
37
                uint32_t _flags_save_STRUCT = ndr->flags;
37
38
                ndr_set_flags(&ndr->flags, LIBNDR_FLAG_NOALIGN);
38
39
                if (ndr_flags & NDR_SCALARS) {
39
40
                        NDR_CHECK(ndr_pull_align(ndr, 4));
40
41
                        NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->uni_name_len));
41
 
                        NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->uni_name, 32, sizeof(uint16_t), CH_UTF16));
 
42
                        size_uni_name_0 = 32;
 
43
                        NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->uni_name, size_uni_name_0, sizeof(uint16_t), CH_UTF16));
42
44
                        NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->pass_len));
43
45
                        {
44
46
                                uint32_t _flags_save_string = ndr->flags;