Attachment 10900 Details for Bug 11174 – 4.2 patch cherry-picked from master

[patch] 4.2 patch cherry-picked from master

0001-backupkey-Use-ndr_pull_struct_blob_all.patch (text/plain), 2.35 KB, created by Andrew Bartlett on 2015-03-20 18:51:30 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andrew Bartlett

Created: 2015-03-20 18:51:30 UTC

Size: 2.35 KB

patch

obsolete

>From c0ca0f56f8ea5319d4f250c8fbd2ed2603a9b04e Mon Sep 17 00:00:00 2001
>From: Andrew Bartlett <abartlet@samba.org>
>Date: Fri, 20 Mar 2015 14:32:00 +1300
>Subject: [PATCH] backupkey: Use ndr_pull_struct_blob_all()
>
>This avoids bad decrypts from falling down to later code and getting
>the error code wrong, by strictly requiring the NDR parse to use all the
>data.  A bad decyrpt is very unlikely to get the length correct, and
>so fall down to the other checks.
>
>This should fix:
>UNEXPECTED(failure): samba4.rpc.backupkey with seal.backupkey.server_wrap_decrypt_wrong_r2(ad_dc_ntvfs)
>REASON: Exception: Exception: ../source4/torture/rpc/backupkey.c:1926: r.out.result was WERR_INVALID_ACCESS, expected WERR_INVALID_PARAM: decrypt should fail with WERR_INVALID_PARAM
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=11174
>Signed-off-by: Andrew Bartlett <abartlet@samba.org>
>Reviewed-by: Stefan (metze) Metzmacher <metze@samba.org>
>(cherry picked from commit e617e3e74b7ea13bcf3ce385f3926e50e38dbe44)
>---
> source4/rpc_server/backupkey/dcesrv_backupkey.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
>diff --git a/source4/rpc_server/backupkey/dcesrv_backupkey.c b/source4/rpc_server/backupkey/dcesrv_backupkey.c
>index bef4c93..069e339 100644
>--- a/source4/rpc_server/backupkey/dcesrv_backupkey.c
>+++ b/source4/rpc_server/backupkey/dcesrv_backupkey.c
>@@ -1492,8 +1492,8 @@ static WERROR bkrp_server_wrap_decrypt_data(struct dcesrv_call_state *dce_call,
> 		return WERR_INVALID_PARAM;
> 	}
> 
>-	ndr_err = ndr_pull_struct_blob(&blob, mem_ctx, &decrypt_request,
>-				       (ndr_pull_flags_fn_t)ndr_pull_bkrp_server_side_wrapped);
>+	ndr_err = ndr_pull_struct_blob_all(&blob, mem_ctx, &decrypt_request,
>+					   (ndr_pull_flags_fn_t)ndr_pull_bkrp_server_side_wrapped);
> 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
> 		return WERR_INVALID_PARAM;
> 	}
>@@ -1530,8 +1530,8 @@ static WERROR bkrp_server_wrap_decrypt_data(struct dcesrv_call_state *dce_call,
> 	
> 	arcfour_crypt_blob(encrypted_blob.data, encrypted_blob.length, &symkey_blob);
> 
>-	ndr_err = ndr_pull_struct_blob(&encrypted_blob, mem_ctx, &rc4payload,
>-				       (ndr_pull_flags_fn_t)ndr_pull_bkrp_rc4encryptedpayload);
>+	ndr_err = ndr_pull_struct_blob_all(&encrypted_blob, mem_ctx, &rc4payload,
>+					   (ndr_pull_flags_fn_t)ndr_pull_bkrp_rc4encryptedpayload);
> 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
> 		return WERR_INVALID_PARAM;
> 	}
>-- 
>1.9.3
>

Flags:

metze: review+

Actions: View

Attachments on bug 11174: 10894 | 10900