net/samba3/patches/600-CVE-2012-1182.patch

   1 --- a/source/librpc/gen_ndr/ndr_wkssvc.c
   2 +++ b/source/librpc/gen_ndr/ndr_wkssvc.c
   3 @@ -1385,10 +1385,10 @@ NTSTATUS ndr_pull_USER_INFO_0_CONTAINER(
   4                         NDR_PULL_ALLOC_N(ndr, r->user0, ndr_get_array_size(ndr, &r->user0));
   5                         _mem_save_user0_1 = NDR_PULL_GET_MEM_CTX(ndr);
   6                         NDR_PULL_SET_MEM_CTX(ndr, r->user0, 0);
   7 -                       for (cntr_user0_1 = 0; cntr_user0_1 < r->entries_read; cntr_user0_1++) {
   8 +                       for (cntr_user0_1 = 0; cntr_user0_1 < ndr_get_array_size(ndr, &r->user0); cntr_user0_1++) {
   9                                 NDR_CHECK(ndr_pull_USER_INFO_0(ndr, NDR_SCALARS, &r->user0[cntr_user0_1]));
  10                         }
  11 -                       for (cntr_user0_1 = 0; cntr_user0_1 < r->entries_read; cntr_user0_1++) {
  12 +                       for (cntr_user0_1 = 0; cntr_user0_1 < ndr_get_array_size(ndr, &r->user0); cntr_user0_1++) {
  13                                 NDR_CHECK(ndr_pull_USER_INFO_0(ndr, NDR_BUFFERS, &r->user0[cntr_user0_1]));
  14                         }
  15                         NDR_PULL_SET_MEM_CTX(ndr, _mem_save_user0_1, 0);
  16 @@ -1631,10 +1631,10 @@ NTSTATUS ndr_pull_USER_INFO_1_CONTAINER(
  17                         NDR_PULL_ALLOC_N(ndr, r->user1, ndr_get_array_size(ndr, &r->user1));
  18                         _mem_save_user1_1 = NDR_PULL_GET_MEM_CTX(ndr);
  19                         NDR_PULL_SET_MEM_CTX(ndr, r->user1, 0);
  20 -                       for (cntr_user1_1 = 0; cntr_user1_1 < r->entries_read; cntr_user1_1++) {
  21 +                       for (cntr_user1_1 = 0; cntr_user1_1 < ndr_get_array_size(ndr, &r->user1); cntr_user1_1++) {
  22                                 NDR_CHECK(ndr_pull_USER_INFO_1(ndr, NDR_SCALARS, &r->user1[cntr_user1_1]));
  23                         }
  24 -                       for (cntr_user1_1 = 0; cntr_user1_1 < r->entries_read; cntr_user1_1++) {
  25 +                       for (cntr_user1_1 = 0; cntr_user1_1 < ndr_get_array_size(ndr, &r->user1); cntr_user1_1++) {
  26                                 NDR_CHECK(ndr_pull_USER_INFO_1(ndr, NDR_BUFFERS, &r->user1[cntr_user1_1]));
  27                         }
  28                         NDR_PULL_SET_MEM_CTX(ndr, _mem_save_user1_1, 0);
  29 @@ -1953,10 +1953,10 @@ NTSTATUS ndr_pull_wkssvc_NetWkstaTranspo
  30                         NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
  31                         _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
  32                         NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
  33 -                       for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
  34 +                       for (cntr_array_1 = 0; cntr_array_1 < ndr_get_array_size(ndr, &r->array); cntr_array_1++) {
  35                                 NDR_CHECK(ndr_pull_wkssvc_NetWkstaTransportInfo0(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
  36                         }
  37 -                       for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
  38 +                       for (cntr_array_1 = 0; cntr_array_1 < ndr_get_array_size(ndr, &r->array); cntr_array_1++) {
  39                                 NDR_CHECK(ndr_pull_wkssvc_NetWkstaTransportInfo0(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
  40                         }
  41                         NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);