Attachment 15743 Details for Bug 14242 – A proposed patch

[patch] A proposed patch

0001-nmblib-avoid-undefined-behaviour-in-handle_name_ptrs.patch (text/plain), 1.24 KB, created by Douglas Bagnall on 2020-01-19 02:25:19 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Douglas Bagnall

Created: 2020-01-19 02:25:19 UTC

Size: 1.24 KB

patch

obsolete

>From 1f41390c3d1e659d8a01a92a068e572013d4b35c Mon Sep 17 00:00:00 2001
>From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
>Date: Sun, 19 Jan 2020 15:08:58 +1300
>Subject: [PATCH] nmblib: avoid undefined behaviour in handle_name_ptrs()
>
>If *offset is length - 1, we would read ubuf[(*offset)+1] as the lower
>bits of the new *offset. This value is undefined, but because it is
>checked against the valid range, there is no way to read future beyond
>that one byte.
>
>Credit to oss-fuzz.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14242
>OSS-FUZZ: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20193
>
>Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
>---
> source3/libsmb/nmblib.c | 3 +++
> 1 file changed, 3 insertions(+)
>
>diff --git a/source3/libsmb/nmblib.c b/source3/libsmb/nmblib.c
>index 84cbb054b8e..c05fac2bba9 100644
>--- a/source3/libsmb/nmblib.c
>+++ b/source3/libsmb/nmblib.c
>@@ -160,6 +160,9 @@ static bool handle_name_ptrs(unsigned char *ubuf,int *offset,int length,
> 		if (!*got_pointer)
> 			(*ret) += 2;
> 		(*got_pointer)=True;
>+		if (*offset > length - 2) {
>+			return False;
>+		}
> 		(*offset) = ((ubuf[*offset] & ~0xC0)<<8) | ubuf[(*offset)+1];
> 		if (loop_count++ == 10 ||
> 				(*offset) < 0 || (*offset)>(length-2)) {
>-- 
>2.20.1
>

Actions: View

Attachments on bug 14242: 15743 | 15809 | 15810 | 15811