From dd362a62a1ae5e6fa0f66032d6a4fe7704ea0555 Mon Sep 17 00:00:00 2001
From: Robert Shearman <rob@codeweavers.com>
Date: Mon, 22 May 2006 12:02:04 +0100
Subject: [PATCH] rpcrt4: Fix copying too much data from the buffer by not
 taking into account the fact that auth_pad_len has been included in the
 fragment length.

---
 dlls/rpcrt4/rpc_message.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/rpcrt4/rpc_message.c b/dlls/rpcrt4/rpc_message.c
index e19735d11f7..ccf33fa4482 100644
--- a/dlls/rpcrt4/rpc_message.c
+++ b/dlls/rpcrt4/rpc_message.c
@@ -304,7 +304,7 @@ static RPC_STATUS RPCRT4_SendAuth(RpcConnection *Connection, RpcPktHdr *Header,
     if (hdr_size == Header->common.frag_len)
       goto write;
 
-    memcpy(pkt + hdr_size, buffer_pos, Header->common.frag_len - hdr_size - alen);
+    memcpy(pkt + hdr_size, buffer_pos, Header->common.frag_len - hdr_size - auth_pad_len - alen);
 
     /* add the authorization info */
     if (Connection->AuthInfo && AuthLength)
-- 
GitLab