31 lines
926 B
Diff
31 lines
926 B
Diff
|
*** src/lib/rpc/svc_auth_gss.c (revision 20474)
|
||
|
|
--- src/lib/rpc/svc_auth_gss.c (local)
|
||
|
|
***************
|
||
|
|
*** 355,360 ****
|
||
|
|
--- 355,369 ----
|
||
|
|
memset(rpchdr, 0, sizeof(rpchdr));
|
||
|
|
|
||
|
|
/* XXX - Reconstruct RPC header for signing (from xdr_callmsg). */
|
||
|
|
+ oa = &msg->rm_call.cb_cred;
|
||
|
|
+ if (oa->oa_length > MAX_AUTH_BYTES)
|
||
|
|
+ return (FALSE);
|
||
|
|
+
|
||
|
|
+ /* 8 XDR units from the IXDR macro calls. */
|
||
|
|
+ if (sizeof(rpchdr) < (8 * BYTES_PER_XDR_UNIT +
|
||
|
|
+ RNDUP(oa->oa_length)))
|
||
|
|
+ return (FALSE);
|
||
|
|
+
|
||
|
|
buf = (int32_t *)(void *)rpchdr;
|
||
|
|
IXDR_PUT_LONG(buf, msg->rm_xid);
|
||
|
|
IXDR_PUT_ENUM(buf, msg->rm_direction);
|
||
|
|
***************
|
||
|
|
*** 362,368 ****
|
||
|
|
IXDR_PUT_LONG(buf, msg->rm_call.cb_prog);
|
||
|
|
IXDR_PUT_LONG(buf, msg->rm_call.cb_vers);
|
||
|
|
IXDR_PUT_LONG(buf, msg->rm_call.cb_proc);
|
||
|
|
- oa = &msg->rm_call.cb_cred;
|
||
|
|
IXDR_PUT_ENUM(buf, oa->oa_flavor);
|
||
|
|
IXDR_PUT_LONG(buf, oa->oa_length);
|
||
|
|
if (oa->oa_length) {
|
||
|
|
--- 371,376 ----
|