sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-24 13:57:43 +03:00
Code

rpc: avoid undefined behaviour when parsing bindings

Browse Source 
If the binding string ends with "[", we were setting options to an
empty string, then asking for 'options[strlen(options)-1]', which
UBSan dosn't like because the offset evaluates to (size_t)0xFFFFF...
causing pointer overflow.

I believe this is actually well defined in practice, but we don't want
to be in the habit of leaving sanitiser warnings in code parsing
untrusted strings.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Douglas Bagnall 2020-10-20 09:42:56 +13:00 committed by Andrew Bartlett
parent 09479bf0ee
commit 302098c325
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
librpc/rpc/binding.c
View File

@ -385,13 +385,14 @@ _PUBLIC_ NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *_s, stru
p = strchr(s, '[');
if (p) {
*p = '\0';
options = p + 1;
if (options[strlen(options)-1] != ']') {
char *q = p + strlen(p) - 1;
if (*q != ']') {
talloc_free(b);
return NT_STATUS_INVALID_PARAMETER_MIX;
}
options[strlen(options)-1] = 0;
*p = '\0';
*q = '\0';
options = p + 1;
}
p = strchr(s, '@');