sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-26 10:04:02 +03:00
Code

gencache: Make gencache_pull_timeout a bit more robust

Browse Source 
The previous version assumed a well-formed "val", we just handed it to
strtol without properly checking that it contains the delimiter. So
strtol could well run off the end of "val" in case of data corruption.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
This commit is contained in:
Volker Lendecke 2018-10-09 13:51:46 +02:00 committed by Jeremy Allison
parent 6007c444d9
commit 34fe8b1ac6
1 changed files with 12 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
source3/lib/gencache.c
View File

@ -408,19 +408,24 @@ bool gencache_del(const char *keystr)
return result;
}
static bool gencache_pull_timeout(uint8_t *val, time_t *pres, char **payload)
static bool gencache_pull_timeout(TDB_DATA data, time_t *pres, char **payload)
{
time_t res;
char *slash = NULL;
char *endptr;
if (val == NULL) {
if (data.dptr == NULL) {
return false;
}
slash = memchr(data.dptr, '/', data.dsize);
if (slash == NULL) {
return false;
}
res = strtol((char *)val, &endptr, 10);
res = strtol((char *)data.dptr, &endptr, 10);
if ((endptr == NULL) || (*endptr != '/')) {
DEBUG(2, ("Invalid gencache data format: %s\n", (char *)val));
DBG_WARNING("Invalid gencache data format\n");
return false;
}
if (pres != NULL) {
@ -451,7 +456,7 @@ static int gencache_parse_fn(TDB_DATA key, TDB_DATA data, void *private_data)
if (data.dptr == NULL) {
return -1;
}
ret = gencache_pull_timeout(data.dptr, &t.timeout, &payload);
ret = gencache_pull_timeout(data, &t.timeout, &payload);
if (!ret) {
return -1;
}
@ -716,7 +721,7 @@ static int stabilize_fn(struct tdb_context *tdb, TDB_DATA key, TDB_DATA val,
return 0;
}
if (!gencache_pull_timeout(val.dptr, &timeout, NULL)) {
if (!gencache_pull_timeout(val, &timeout, NULL)) {
DEBUG(10, ("Ignoring invalid entry\n"));
return 0;
}
@ -841,7 +846,7 @@ static int gencache_iterate_blobs_fn(struct tdb_context *tdb, TDB_DATA key,
}
}
if (!gencache_pull_timeout(data.dptr, &timeout, &payload)) {
if (!gencache_pull_timeout(data, &timeout, &payload)) {
goto done;
}