The branch, master has been updated via 1cd0fe9 ndr_string: Do overflow checks in ndr_push/pull_charset via 360804e ndr_string: Fix a signed/unsigned glitch from 4e0cf2f ctdb-tests: Delete unused fake /etc/sysconfig/ctdb file
https://git.samba.org/?p=samba.git;a=shortlog;h=master - Log ----------------------------------------------------------------- commit 1cd0fe90cf642de4ab4d03819f87a13c20bd2805 Author: Volker Lendecke <v...@samba.org> Date: Mon Mar 26 12:02:01 2018 +0200 ndr_string: Do overflow checks in ndr_push/pull_charset Signed-off-by: Volker Lendecke <v...@samba.org> Reviewed-by: Andreas Schneider <a...@samba.org> Autobuild-User(master): Volker Lendecke <v...@samba.org> Autobuild-Date(master): Wed Mar 28 16:08:16 CEST 2018 on sn-devel-144 commit 360804ed4f7d3ab7375ba68885fed4584ef0a438 Author: Volker Lendecke <v...@samba.org> Date: Mon Mar 26 12:00:40 2018 +0200 ndr_string: Fix a signed/unsigned glitch Signed-off-by: Volker Lendecke <v...@samba.org> Reviewed-by: Andreas Schneider <a...@samba.org> ----------------------------------------------------------------------- Summary of changes: librpc/ndr/ndr_string.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) Changeset truncated at 500 lines: diff --git a/librpc/ndr/ndr_string.c b/librpc/ndr/ndr_string.c index 067f917..cc35086 100644 --- a/librpc/ndr/ndr_string.c +++ b/librpc/ndr/ndr_string.c @@ -588,6 +588,9 @@ _PUBLIC_ enum ndr_err_code ndr_pull_charset(struct ndr_pull *ndr, int ndr_flags, chset = CH_UTF16BE; } + if ((byte_mul != 0) && (length > UINT32_MAX/byte_mul)) { + return ndr_pull_error(ndr, NDR_ERR_BUFSIZE, "length overflow"); + } NDR_PULL_NEED_BYTES(ndr, length*byte_mul); if (!convert_string_talloc(ndr->current_mem_ctx, chset, CH_UNIX, @@ -636,12 +639,15 @@ _PUBLIC_ enum ndr_err_code ndr_pull_charset_to_null(struct ndr_pull *ndr, int nd _PUBLIC_ enum ndr_err_code ndr_push_charset(struct ndr_push *ndr, int ndr_flags, const char *var, uint32_t length, uint8_t byte_mul, charset_t chset) { - ssize_t required; + size_t required; if (NDR_BE(ndr) && chset == CH_UTF16) { chset = CH_UTF16BE; } + if ((byte_mul != 0) && (length > SIZE_MAX/byte_mul)) { + return ndr_push_error(ndr, NDR_ERR_LENGTH, "length overflow"); + } required = byte_mul * length; NDR_PUSH_NEED_BYTES(ndr, required); -- Samba Shared Repository