Bug 14188 - ndr_pull_winreg_QueryMultipleValues2 crash
Summary: ndr_pull_winreg_QueryMultipleValues2 crash
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: DCE-RPCs and pipes (show other bugs)
Version: 4.10.6
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Andrew Bartlett
QA Contact: Samba QA Contact
Depends on:
Reported: 2019-11-06 21:49 UTC by Douglas Bagnall
Modified: 2019-11-21 06:24 UTC (History)
0 users

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description Douglas Bagnall 2019-11-06 21:49:47 UTC
echo -n 'AAAAAAAAAAAAAAAAuB8ALDQgEAAAAAAAAAAAAAC4HwAtNDg3OQ==' | base64 -d | bin/ndrdump winreg 34 out

The out part of the struct is referring to the in, but the in values are all NULL.
Comment 1 Andrew Bartlett 2019-11-08 18:33:51 UTC
In this case ndrdump is crashing because an out packet was presented without the in packet for context, and a size_is variable referenced a ref pointer that was not provided.  It is not a security issue because in genuine callers don't do that.

It is however quite annoying for ndrdump to crash, but if we were to fake up the in packet we would instead give an incorrect parse failure, so we can't easily win here.
Comment 2 Andrew Bartlett 2019-11-21 06:24:54 UTC
Removing embargo.  The fix is to patch the NDR code when building the fuzzers (only) to create and zero in these 'in' ref pointers during 'out' parsing.