Attachment 15717 Details for Bug 14219 – patch for 4.11

[patch] patch for 4.11

v4-11-test.patch (text/plain), 2.60 KB, created by Andreas Schneider on 2019-12-20 10:23:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andreas Schneider

Created: 2019-12-20 10:23:28 UTC

Size: 2.60 KB

patch

obsolete

>From e4cedff98dddda9c89dfbdd7bb1e447bf9fa9784 Mon Sep 17 00:00:00 2001
>From: Andreas Schneider <asn@samba.org>
>Date: Mon, 16 Dec 2019 15:50:17 +0100
>Subject: [PATCH] librpc: Fix string length checking in
> ndr_pull_charset_to_null()
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14219
>
>Pair-Programmed-With: Guenther Deschner <gd@samba.org>
>Signed-off-by: Guenther Deschner <gd@samba.org>
>Signed-off-by: Andreas Schneider <asn@samba.org>
>Reviewed-by: Andrew Bartlett <abartlet@samba.org>
>(cherry picked from commit f11e207e01c52566c47e350ff240fe95392de0c3)
>---
> librpc/ndr/ndr_string.c | 49 +++++++++++++++++++++++++++++++++++++++--
> 1 file changed, 47 insertions(+), 2 deletions(-)
>
>diff --git a/librpc/ndr/ndr_string.c b/librpc/ndr/ndr_string.c
>index 0fefc887c30..3def351072c 100644
>--- a/librpc/ndr/ndr_string.c
>+++ b/librpc/ndr/ndr_string.c
>@@ -553,6 +553,47 @@ _PUBLIC_ uint32_t ndr_string_length(const void *_var, uint32_t element_size)
> 	return i+1;
> }
> 
>+/**
>+ * @brief Get the string length including the null terminator if available.
>+ *
>+ * This checks the string length based on the elements. The returned number
>+ * includes the terminating null byte(s) if found.
>+ *
>+ * @param[in]  _var    The string the calculate the length for.
>+ *
>+ * @param[in]  length  The length of the buffer passed by _var.
>+ *
>+ * @param[in]  element_size The element_size of a string char in bytes.
>+ *
>+ * @return The length of the strings or 0.
>+ */
>+static uint32_t ndr_string_n_length(const void *_var,
>+				    size_t length,
>+				    uint32_t element_size)
>+{
>+	size_t i = 0;
>+	uint8_t zero[4] = {0,0,0,0};
>+	const char *var = (const char *)_var;
>+	int cmp;
>+
>+	if (element_size > 4) {
>+		return 0;
>+	}
>+
>+	for (i = 0; i < length; i++, var += element_size) {
>+		cmp = memcmp(var, zero, element_size);
>+		if (cmp == 0) {
>+			break;
>+		}
>+	}
>+
>+	if (i == length) {
>+		return length;
>+	}
>+
>+	return i + 1;
>+}
>+
> _PUBLIC_ enum ndr_err_code ndr_check_string_terminator(struct ndr_pull *ndr, uint32_t count, uint32_t element_size)
> {
> 	uint32_t i;
>@@ -622,8 +663,12 @@ _PUBLIC_ enum ndr_err_code ndr_pull_charset_to_null(struct ndr_pull *ndr, int nd
> 
> 	NDR_PULL_NEED_BYTES(ndr, length*byte_mul);
> 
>-	str_len = ndr_string_length(ndr->data+ndr->offset, byte_mul);
>-	str_len = MIN(str_len, length);	/* overrun protection */
>+	str_len = ndr_string_n_length(ndr->data+ndr->offset, length, byte_mul);
>+	if (str_len == 0) {
>+		return ndr_pull_error(ndr, NDR_ERR_LENGTH,
>+				      "Invalid length");
>+	}
>+
> 	if (!convert_string_talloc(ndr->current_mem_ctx, chset, CH_UNIX,
> 				   ndr->data+ndr->offset, str_len*byte_mul,
> 				   discard_const_p(void *, var),
>-- 
>2.24.0
>

Flags:

slow: review+

Actions: View

Attachments on bug 14219: 15690 | 15717 | 15718