librpc/rpc: let dcerpc_read_ncacn_packet_next_vector() handle fragmen…

…ts without any payload DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED don't have any payload by default. In order to receive them via dcerpc_read_ncacn_packet_send/recv we need to allow fragments with frag_len == DCERPC_NCACN_PAYLOAD_OFFSET. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15446 Signed-off-by: Stefan Metzmacher <[email protected]> Reviewed-by: Volker Lendecke <[email protected]> (cherry picked from commit 5c724a3)
arter97 · Aug 8, 2023 · b9e4804 · b9e4804
1 parent a436b0d
commit b9e4804
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/librpc/rpc/dcerpc_util.c b/librpc/rpc/dcerpc_util.c
@@ -565,9 +565,14 @@ static int dcerpc_read_ncacn_packet_next_vector(struct tstream_context *stream,
 
 		ofs = state->buffer.length;
 
-		if (frag_len < ofs) {
+		if (frag_len <= ofs) {
 			/*
-			 * something is wrong, let the caller deal with it
+			 * With frag_len == ofs, we are done, this is likely
+			 * a DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED
+			 * without any payload.
+			 *
+			 * Otherwise it's a broken packet and we
+			 * let the caller deal with it.
 			 */
 			*_vector = NULL;
 			*_count = 0;