sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-22 22:04:08 +03:00
Code

librpc ndr tests: uint32 overflow in NDR_PULL_ALIGN

Browse Source 
Check that uint32 overflow is handled correctly by NDR_NEED_BYTES.

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20083
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14236

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Gary Lockyer 2020-01-24 15:21:47 +13:00 committed by Andrew Bartlett
parent ae6927e4f0
commit 46edde8647
2 changed files with 35 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
librpc/tests/test_ndr.c
View File

@ -73,10 +73,44 @@ static void test_NDR_PULL_NEED_BYTES(void **state)
assert_int_equal(NDR_ERR_BUFSIZE, err);
}
/*
* Test NDR_PULL_ALIGN integer overflow handling.
*/
static enum ndr_err_code wrap_NDR_PULL_ALIGN(
struct ndr_pull *ndr,
uint32_t bytes) {
NDR_PULL_ALIGN(ndr, bytes);
return NDR_ERR_SUCCESS;
}
static void test_NDR_PULL_ALIGN(void **state)
{
struct ndr_pull ndr = {0};
enum ndr_err_code err;
ndr.data_size = UINT32_MAX;
ndr.offset = UINT32_MAX -1;
/*
* This will not cause an overflow
*/
err = wrap_NDR_PULL_ALIGN(&ndr, 2);
assert_int_equal(NDR_ERR_SUCCESS, err);
/*
* This will cause an overflow
* and (offset + n) will be less than data_size
*/
err = wrap_NDR_PULL_ALIGN(&ndr, 4);
assert_int_equal(NDR_ERR_BUFSIZE, err);
}
int main(int argc, const char **argv)
{
const struct CMUnitTest tests[] = {
cmocka_unit_test(test_NDR_PULL_NEED_BYTES),
cmocka_unit_test(test_NDR_PULL_ALIGN),
};
cmocka_set_message_output(CM_OUTPUT_SUBUNIT);

1
selftest/knownfail.d/bug-14236
View File

@ -1 +1,2 @@
^samba.tests.blackbox.ndrdump.samba.tests.blackbox.ndrdump.NdrDumpTests.test_ndrdump_fuzzed_ndr_compression
^librpc.ndr.ndr.test_NDR_PULL_ALIGN