netsniff-ng.git - A high-performance Linux networking toolkit

Age	Commit message (Expand)	Author	Files	Lines
2013-06-11	irq: do not process non-existant irq number of lo	Daniel Borkmann	1	-0/+2
2013-06-04	xutils: eliminate xutils, move rest to epoll2	Daniel Borkmann	1	-8/+1
2013-06-04	irq: rename device_bind_irq_to_cpu to device_set_irq_affinity	Daniel Borkmann	1	-1/+1
2013-06-04	xutils: break out string handling and locking	Daniel Borkmann	1	-0/+1
2013-06-03	irq: break out from xutils and save + restore	Daniel Borkmann	1	-0/+129

of(struct _AUTHENTICATE_MESSAGE) (320B on x86_64). I don't know where this value comes from or if it was ever appropriate, but it is currently insufficient: the user and domain name in UTF16 could take 1kB by themselves. Because of that, build_ntlmssp_auth_blob() might corrupt memory (out-of-bounds write). The size of ntlmssp_blob in SMB2_sess_setup() is too small too (sizeof(struct _NEGOTIATE_MESSAGE) + 500). This patch allocates the blob dynamically in build_ntlmssp_auth_blob(). Signed-off-by: Jerome Marchand <jmarchan@redhat.com> Signed-off-by: Steve French <smfrench@gmail.com> CC: Stable <stable@vger.kernel.org>

Diffstat