Bug 16239 - kdc default domain supported enctypes ignores uppercase 0X hex values and reads one byte out of bounds on a 0 token
Summary: kdc default domain supported enctypes ignores uppercase 0X hex values and rea...
Status: RESOLVED FIXED
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: Other (show other bugs)
Version: unspecified
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Samba release manager
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-09-08 16:38 UTC by pkopylov
Modified: 2026-10-01 19:47 UTC (History)
2 users (show)

See Also:

Attachments
backport for Samba 4.25 (9.41 KB, patch)
2026-09-14 03:37 UTC, Jennifer Sutton 		vl: review+
Details
backport for Samba 4.24 (9.41 KB, patch)
2026-09-14 03:38 UTC, Jennifer Sutton 		vl: review+
Details
backport for Samba 4.23 (9.41 KB, patch)
2026-09-14 03:38 UTC, Jennifer Sutton 		vl: review+
Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description pkopylov 2026-09-08 16:38:09 UTC 
handle_kdc_default_domain_supported_enctypes() detects a hex prefix with:

(bitstr[1] == 'x' || bitstr[2] == 'X') — the second index should be bitstr[1]. 

See: https://gitlab.com/samba-team/samba/-/blob/master/lib/param/loadparm.c#L1862

Consequences: (1) an uppercase value like 0X1F isn't seen as hex, is parsed base-10 via smb_strtoul(..., SMB_STR_FULL_STR_CONV), fails on the X, and is dropped with a warning; (2) a bare 0 token falls through to bitstr[2], one byte past the 2-byte buffer "0\0" (OOB read). Input is admin-only smb.conf, so no remote exposure. 

Observe: set kdc default domain supported enctypes = 0X1F -> bit not applied + warning, while 0x1f works. 

Fix: https://gitlab.com/samba-team/samba/-/merge_requests/4696
Comment 1 pkopylov 2026-09-08 18:06:40 UTC 
The correct MR is https://gitlab.com/samba-team/samba/-/merge_requests/4697
Comment 2 Samba QA Contact 2026-09-11 16:11:03 UTC 
This bug was referenced in samba master:

608afbe571a6314adfd191e2b069ac3ff66f7c93
27c87a723ba3e2e9d36df8736641d3c191bf4aa2
a1979f9b976a9f0f0505068ce2b4fa057eb7072c
b54246e258dd3dbd94a112ac460318b27de1d6fd
Comment 3 Jennifer Sutton 2026-09-14 03:37:38 UTC 
Created attachment 19206 [details]
backport for Samba 4.25
Comment 4 Jennifer Sutton 2026-09-14 03:38:08 UTC 
Created attachment 19207 [details]
backport for Samba 4.24
Comment 5 Jennifer Sutton 2026-09-14 03:38:29 UTC 
Created attachment 19208 [details]
backport for Samba 4.23
Comment 6 Samba QA Contact 2026-09-14 20:55:12 UTC 
This bug was referenced in samba v4-24-test:

9e347e1f714cda41f5cd929c37e8f5c8f51b902b
bf24b4c84cbcf7caa5ca93557f436b87777a997a
7597772949c2fdd566139908d0b10829027e58c0
bb20b83dbd5d6044886cf68d26b87f80f941fcaf
Comment 7 Samba QA Contact 2026-09-15 18:58:12 UTC 
This bug was referenced in samba v4-23-test:

966688b44ad96b71cf131956339c2e02247550ff
3dafde5c6b4f440f529c73ae7ffc6f6429b32732
3c18fb4a9f7dcbe88452b5b94dc3ae657c86f638
8a1fd13cd7e78903df5c4256aee0b64eb3fa6778
Comment 8 Samba QA Contact 2026-09-16 18:29:20 UTC 
This bug was referenced in samba v4-25-test:

e83f62cc9a1f1956d72c3b98a83ea702a07c9415
cb8236db7ab1c030b807cce818f88855e34ced52
a3a440d34b4b32c41ee73ccbdd74190fc6acb7dc
6b36081c83a58d8f838e38ade34261899a333031
Comment 9 Samba QA Contact 2026-09-24 21:59:16 UTC 
This bug was referenced in samba v4-25-stable (Release samba-4.25.0):

e83f62cc9a1f1956d72c3b98a83ea702a07c9415
cb8236db7ab1c030b807cce818f88855e34ced52
a3a440d34b4b32c41ee73ccbdd74190fc6acb7dc
6b36081c83a58d8f838e38ade34261899a333031
Comment 10 Samba QA Contact 2026-10-01 19:47:31 UTC 
This bug was referenced in samba v4-23-stable (Release samba-4.23.13):

966688b44ad96b71cf131956339c2e02247550ff
3dafde5c6b4f440f529c73ae7ffc6f6429b32732
3c18fb4a9f7dcbe88452b5b94dc3ae657c86f638
8a1fd13cd7e78903df5c4256aee0b64eb3fa6778