sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-08 21:18:16 +03:00
Code

lib/replace - add extra check to bsd_attr_list

Browse Source 
The FreeBSD extattr API may return success and truncated
namelist. We need to check for this in bsd_attr_list to
ensure that we don't accidentally read off the end of the
buffer. In the case of a truncated value, the pascal
strings for attr names will reflect the lengths as if
the value were not truncated. For example:
`58DosStrea`

In case of short read we now set error to ERANGE and
fail.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15271

Signed-off-by: Andrew Walker <awalker@ixsystems.com>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Mon Jan  2 14:27:23 UTC 2023 on sn-devel-184

(cherry picked from commit 01cdc5e00b)

Autobuild-User(v4-16-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-16-test): Mon Jan 23 10:59:28 UTC 2023 on sn-devel-184
This commit is contained in:
Andrew Walker 2022-12-27 10:59:14 -05:00 committed by Jule Anger
parent 1189604995
commit eddd14cedb
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
lib/replace/xattr.c
View File

@ -266,6 +266,18 @@ static ssize_t bsd_attr_list (int type, extattr_arg arg, char *list, size_t size
for(i = 0; i < list_size; i += len + 1) {
len = buf[i];
/*
* If for some reason we receive a truncated
* return from call to list xattrs the pascal
* string lengths will not be changed and
* therefore we must check that we're not
* reading garbage data or off end of array
*/
if (len + i >= list_size) {
errno = ERANGE;
return -1;
}
strncpy(list, extattr[t].name, extattr[t].len + 1);
list += extattr[t].len;
strncpy(list, buf + i + 1, len);