sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-22 13:34:15 +03:00
Code

librpc/ndr: let ndr_push_string() let s_len == 0 result in d_len = 0

Browse Source 
convert_string_talloc_handle() tries to play an the safe side
and always returns a null terminated array.

But for NDR we need to be correct on the wire...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14956

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
This commit is contained in:
Stefan Metzmacher 2021-11-03 13:57:50 +01:00
parent 8da26cb672
commit 43648e95a5
3 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
librpc/ndr/ndr_string.c
View File

@ -236,7 +236,10 @@ _PUBLIC_ enum ndr_err_code ndr_push_string(struct ndr_push *ndr, int ndr_flags,
s_len++;
}
if (!do_convert) {
if (s_len == 0) {
d_len = 0;
dest = (uint8_t *)talloc_strdup(ndr, "");
} else if (!do_convert) {
d_len = s_len;
dest = (uint8_t *)talloc_strndup(ndr, s, s_len);
} else if (!convert_string_talloc(ndr, CH_UNIX, chset, s, s_len,

1
selftest/knownfail.d/blackbox.ndrdump Normal file
View File

@ -0,0 +1 @@
^samba.tests.blackbox.ndrdump.samba.tests.blackbox.ndrdump.NdrDumpTests.test_ndrdump_fuzzed_NULL_struct_ntlmssp_CHALLENGE_MESSAGE

2
selftest/knownfail.d/ndr_string
View File

@ -1,2 +0,0 @@
^samba4.local.ndr.ndr_string.ndr_string
^samba4.local.ndr.system.iconv.ndr_string.ndr_string