From 718e682a1d4b1282e5f0f0c678b620d73e6d9e9e Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Sun, 19 Jan 2020 15:08:58 +1300 Subject: [PATCH] nmblib: avoid undefined behaviour in handle_name_ptrs() If *offset is length - 1, we would read ubuf[(*offset)+1] as the lower bits of the new *offset. This value is undefined, but because it is checked against the valid range, there is no way to read further beyond that one byte. Credit to oss-fuzz. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14242 OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20193 Signed-off-by: Douglas Bagnall Reviewed-by: Jeremy Allison Reviewed-by: Andrew Bartlett Autobuild-User(master): Andrew Bartlett Autobuild-Date(master): Fri Feb 7 10:19:39 UTC 2020 on sn-devel-184 (cherry picked from commit 3bc7acc62646b105b03fd3c65e9170a373f95392) --- source3/libsmb/nmblib.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/source3/libsmb/nmblib.c b/source3/libsmb/nmblib.c index 0681450bae2..8d387fe8120 100644 --- a/source3/libsmb/nmblib.c +++ b/source3/libsmb/nmblib.c @@ -160,6 +160,9 @@ static bool handle_name_ptrs(unsigned char *ubuf,int *offset,int length, if (!*got_pointer) (*ret) += 2; (*got_pointer)=True; + if (*offset > length - 2) { + return False; + } (*offset) = ((ubuf[*offset] & ~0xC0)<<8) | ubuf[(*offset)+1]; if (loop_count++ == 10 || (*offset) < 0 || (*offset)>(length-2)) { -- 2.17.1