sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-21 18:04:06 +03:00
Code

CVE-2022-32742: s4: torture: Add raw.write.bad-write test.

Browse Source 
Reproduces the test code in:

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15085

Add knownfail.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
This commit is contained in:
Jeremy Allison 2022-06-07 09:40:45 -07:00 committed by Jule Anger
parent a6231af1f1
commit f6e1750c4f
2 changed files with 91 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
selftest/knownfail.d/bad-write Normal file
View File

@ -0,0 +1,2 @@
^samba3.raw.write.bad-write\(nt4_dc_smb1\)
^samba3.raw.write.bad-write\(ad_dc_smb1\)

89
source4/torture/raw/write.c
View File

@ -25,6 +25,7 @@
#include "libcli/libcli.h"
#include "torture/util.h"
#include "torture/raw/proto.h"
#include "libcli/raw/raw_proto.h"
#define CHECK_STATUS(status, correct) do { \
if (!NT_STATUS_EQUAL(status, correct)) { \
@ -694,6 +695,93 @@ done:
return ret;
}
/*
test a deliberately bad SMB1 write.
*/
static bool test_bad_write(struct torture_context *tctx,
struct smbcli_state *cli)
{
bool ret = false;
int fnum = -1;
struct smbcli_request *req = NULL;
const char *fname = BASEDIR "\\badwrite.txt";
bool ok = false;
if (!torture_setup_dir(cli, BASEDIR)) {
torture_fail(tctx, "failed to setup basedir");
}
torture_comment(tctx, "Testing RAW_BAD_WRITE\n");
fnum = smbcli_open(cli->tree, fname, O_RDWR|O_CREAT, DENY_NONE);
if (fnum == -1) {
torture_fail_goto(tctx,
done,
talloc_asprintf(tctx,
"Failed to create %s - %s\n",
fname,
smbcli_errstr(cli->tree)));
}
req = smbcli_request_setup(cli->tree,
SMBwrite,
5,
0);
if (req == NULL) {
torture_fail_goto(tctx,
done,
talloc_asprintf(tctx, "talloc fail\n"));
}
SSVAL(req->out.vwv, VWV(0), fnum);
SSVAL(req->out.vwv, VWV(1), 65535); /* bad write length. */
SIVAL(req->out.vwv, VWV(2), 0); /* offset */
SSVAL(req->out.vwv, VWV(4), 0); /* remaining. */
if (!smbcli_request_send(req)) {
torture_fail_goto(tctx,
done,
talloc_asprintf(tctx, "Send failed\n"));
}
if (!smbcli_request_receive(req)) {
torture_fail_goto(tctx,
done,
talloc_asprintf(tctx, "Reveive failed\n"));
}
/*
* Check for expected error codes.
* ntvfs returns NT_STATUS_UNSUCCESSFUL.
*/
ok = (NT_STATUS_EQUAL(req->status, NT_STATUS_INVALID_PARAMETER) ||
NT_STATUS_EQUAL(req->status, NT_STATUS_UNSUCCESSFUL));
if (!ok) {
torture_fail_goto(tctx,
done,
talloc_asprintf(tctx,
"Should have returned "
"NT_STATUS_INVALID_PARAMETER or "
"NT_STATUS_UNSUCCESSFUL "
"got %s\n",
nt_errstr(req->status)));
}
ret = true;
done:
if (req != NULL) {
smbcli_request_destroy(req);
}
if (fnum != -1) {
smbcli_close(cli->tree, fnum);
}
smb_raw_exit(cli->session);
smbcli_deltree(cli->tree, BASEDIR);
return ret;
}
/*
basic testing of write calls
*/
@ -705,6 +793,7 @@ struct torture_suite *torture_raw_write(TALLOC_CTX *mem_ctx)
torture_suite_add_1smb_test(suite, "write unlock", test_writeunlock);
torture_suite_add_1smb_test(suite, "write close", test_writeclose);
torture_suite_add_1smb_test(suite, "writex", test_writex);
torture_suite_add_1smb_test(suite, "bad-write", test_bad_write);
return suite;
}