[gnurl] 23/222: smb: check for full size message before reading message details

[gnunet]

This is an automated email from the git hooks/post-receive script.

ng0 pushed a commit to branch master
in repository gnurl.

commit 6de10536928d212387cc22fbf6e9793f260fc390
Author: Daniel Stenberg <address@hidden>
AuthorDate: Mon Sep 16 10:15:05 2019 +0200

    smb: check for full size message before reading message details
    
    To avoid reading of uninitialized data.
    
    Assisted-by: Max Dymond
    Bug: https://crbug.com/oss-fuzz/16907
    Closes #4363
---
 lib/smb.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/smb.c b/lib/smb.c
index f66c05ca4..12f99257f 100644
--- a/lib/smb.c
+++ b/lib/smb.c
@@ -682,7 +682,8 @@ static CURLcode smb_connection_state(struct connectdata 
*conn, bool *done)
 
   switch(smbc->state) {
   case SMB_NEGOTIATE:
-    if(h->status || smbc->got < sizeof(*nrsp) + sizeof(smbc->challenge) - 1) {
+    if((smbc->got < sizeof(*nrsp) + sizeof(smbc->challenge) - 1) ||
+       h->status) {
       connclose(conn, "SMB: negotiation failed");
       return CURLE_COULDNT_CONNECT;
     }

-- 
To stop receiving notification emails like this one, please contact
address@hidden.