moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2025-02-28 17:31:46 -05:00
Code Issues Releases Wiki Activity

smb: check for full size message before reading message details

Browse Source 
To avoid reading of uninitialized data.

Assisted-by: Max Dymond
Bug: https://crbug.com/oss-fuzz/16907
Closes #4363
This commit is contained in:
Daniel Stenberg 2019-09-16 10:15:05 +02:00
parent 00da834156
commit 6de1053692
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
lib/smb.c
View File

@ -682,7 +682,8 @@ static CURLcode smb_connection_state(struct connectdata *conn, bool *done)
switch(smbc->state) { switch(smbc->state) {
case SMB_NEGOTIATE: case SMB_NEGOTIATE:
if(h->status || smbc->got < sizeof(*nrsp) + sizeof(smbc->challenge) - 1) { if((smbc->got < sizeof(*nrsp) + sizeof(smbc->challenge) - 1) ||
h->status) {
connclose(conn, "SMB: negotiation failed"); connclose(conn, "SMB: negotiation failed");
return CURLE_COULDNT_CONNECT; return CURLE_COULDNT_CONNECT;
} }