1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
Commit Graph

120292 Commits

Author SHA1 Message Date
Noel Power
f26c678a2c s3/script/tests: Allow test script to accept option protocol list
test_preserve_case.sh tests a range of protocols, this however
fails when running against the normal test env (which have min
protocol of SMB2) because one of the protocols is NT1. This change
allows tests to pass the protocol (or list of protocols) so that
tests can be split.

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-12-05 17:14:46 +00:00
Ralph Boehme
f56314a97c s3/selftest: Run samba3.blackbox.net.misc with smb1/smb2
samba3.blackbox.net.misc now can run with >=SMB2 or SMB1 protocols,
adjust previous test definition and add new one

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-12-05 17:14:46 +00:00
Noel Power
d4d2e0175a s3/selftest: split SMB1 & SMB2 parts of samba3.blackbox.dfree_quota
samba3.blackbox.dfree_quota was almost exclusively a SMB3 test, only
one part was testing legacy SMB1 behaviour, this change splits this
out so the SMB1 part can be run independantly.

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-12-05 17:14:46 +00:00
Noel Power
7c0ccbe1a0 s3/script/tests: Prepare to split samba3.blackbox.net.misc for SMB1/SMB2
modify test_net_misc.sh to accept optional protocol, no protocol
specified and it behaves more or less as before (expect this time the
client max protocol is explicitly speficied)

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-12-05 17:14:46 +00:00
Noel Power
b4b25128b8 s3/selftest: allow samba3.blackbox.dfree_command run NT1 & SMB3 tests
samba3.blackbox.dfree_command was a single test that run both NT1 &
SMB3 tests together. This allow the protocol to be passed into the test
script so the test can be divided into SMB1 & >=SM2 tests.

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-12-05 17:14:46 +00:00
Ralph Boehme
2ffccf9c01 selftest: fix a flapping test
The previous approach of using ls | grep $NAME for testing whether the previous
directory removal succeeded will fail in case $NAME is a substring of any
directory entrie's name.

Eg

  NAME=tmp.123

and the directory contains an unrelated entry

  tmp.123456

Using allinfo instead should fix this.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-12-05 17:14:46 +00:00
Andreas Schneider
ea1c62f3c7 ldb:tests: Allow test filtering in ldb_mod_op_test
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Dec  5 17:13:36 UTC 2019 on sn-devel-184
2019-12-05 17:13:36 +00:00
Andreas Schneider
520bb70dfd ldb:tests: Avoid that the debug function overwrites memory
We are setting ldb_debug_string() as the ldb debug function. The context
we give it is only valid as long as we're in that function.

On failure, we jump to the teardown function. The pointer for
debug_string isn't valid anymore, but the ldb debug system still points
to that address, and when we store the location of the allocated string,
we overwrite memory, in that case something from talloc and a
talloc_free() then jumps into the nirvana.

Thanks to Florian Weimer who helped debugging this.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
2019-12-05 15:35:37 +00:00
Jeremy Allison
8db0c1bff6 s3: smbd: Only set xconn->smb1.negprot.done = true after supported_protocols[protocol].proto_reply_fn() succeeds.
Otherwise we can end up with negprot.done set, but
without smbXsrv_connection_init_tables() being called.

This can cause a client self-crash.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14205

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Dec  4 21:27:24 UTC 2019 on sn-devel-184
2019-12-04 21:27:24 +00:00
Jeremy Allison
46899ecf83 python: tests. Add test for fuzzing smbd crash bug.
Mark knownfail for now.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14205

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-12-04 20:02:40 +00:00
Jeremy Allison
e84910d919 s3: smbd: Ensure we exit if supported_protocols[protocol].proto_reply_fn() fails.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14205

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-12-04 20:02:40 +00:00
Jeremy Allison
f4caa4159b s3: smbd: Change (*proto_reply_fn()) to return an NTSTATUS.
That way the caller can know if the negprot really
succeeded or not.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14205

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-12-04 20:02:40 +00:00
Jeremy Allison
836219c479 s3: smbd: Change reply_smb20xx() to return NTSTATUS.
Not yet used.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14205

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-12-04 20:02:40 +00:00
Jeremy Allison
a2d81d77c1 s3: smbd: Ensure we exit on smbd_smb2_process_negprot() fail.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14205

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-12-04 20:02:40 +00:00
Jeremy Allison
868bc05cf5 s3: smbd: Allow smbd_smb2_process_negprot() to return NTSTATUS as it can fail.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14205

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-12-04 20:02:40 +00:00
Douglas Bagnall
eddd6c5267 pidl: don't export parser class methods
These methods are not used or usable as exported functions. The
correct (and actual) usage is along these lines;

    require Parse::Pidl::Samba3::ClientNDR;
    my $generator = new Parse::Pidl::Samba3::ClientNDR();
    my ($c_code,$h_code) = $generator->Parse($ndr, $header, $c_header);

where the methods are either explicitly referenced (new A::B::C),
or are called from the blessed object, neither of which need
exporting.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Dec  4 06:35:06 UTC 2019 on sn-devel-184
2019-12-04 06:35:05 +00:00
Douglas Bagnall
8429418a88 pidl s4/TDR: use Parse::Pidl::Base
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-12-04 05:10:32 +00:00
Douglas Bagnall
12f6698f76 pidl s4/TDR: use conventional ->{res} name
rather than ->{ret}, meaning this class can be moved to a Pidl::Base subclass

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-12-04 05:10:31 +00:00
Douglas Bagnall
fd68ba8a10 pidl: s4/NDR/Parser uses Pidl::Base
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-12-04 05:10:31 +00:00
Douglas Bagnall
574c8db54c pidl s4/NDR/Client: use Pidl::Base
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-12-04 05:10:31 +00:00
Douglas Bagnall
3fc222a122 pidl s4/NDR/Client: fix pidl_both()
This function was clearly meant to be adding output to both the .c and
.h files, but was only adding it to the .h due to a typo.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-12-04 05:10:31 +00:00
Douglas Bagnall
803d9cf8dd pidl s4::Python uses Pidl::Base
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-12-04 05:10:31 +00:00
Douglas Bagnall
5513558bb4 pidl:: adjust s4::Python pidl_hdr() to be the same as others
The common case is for pidl_hdr() to add a "\n", which we can
easily do here, allowing this to be merged into the Pidl::Base borg.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-12-04 05:10:31 +00:00
Douglas Bagnall
4f0fba1886 pidl Samba3::ClientNDR uses Pidl::Base
We need to modify the '@ISA = ' line, because it overwrites
the inheritance from Pidl::Base.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-12-04 05:10:31 +00:00
Douglas Bagnall
a78f69cb7d pidl: optionally annotate output for debug purposes
It can sometimes be hard to tell which bit of pidl generated which bit
of C. This commit wants to help.

If the PIDL_DEVELOPER environment variable is set (via waf
--pidl-developer or some other means), pidl will annotate *most* C
indicating which lines were generated by which bits of pidl. It looks
something like this:

_PUBLIC_ enum ndr_err_code ndr_push_auth_session_info(struct ndr_push *ndr, int ndr_flags, const struct auth_session_info *r)
{  //:PIDL: Parse::Pidl::Samba4::NDR::Parser::ParseTypePushFunction  lib/Parse/Pidl/Samba4/NDR/Parser.pm:3079
	NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);  //:PIDL: Parse::Pidl::Samba4::NDR::Parser::ParseStructPush  lib/Parse/Pidl/Samba4/NDR/Parser.pm:604
	if (ndr_flags & NDR_SCALARS) {
		NDR_CHECK(ndr_push_align(ndr, 5));  //:PIDL: Parse::Pidl::Samba4::NDR::Parser::ParseStructPushPrimitives  lib/Parse/Pidl/Samba4/NDR/Parser.pm:1448
		NDR_CHECK(ndr_push_unique_ptr(ndr, r->security_token));  //:PIDL: Parse::Pidl::Samba4::NDR::Parser::ParsePtrPush  lib/Parse/Pidl/Samba4/NDR/Parser.pm:604
		NDR_CHECK(ndr_push_unique_ptr(ndr, r->unix_token));
		NDR_CHECK(ndr_push_unique_ptr(ndr, r->info));
		NDR_CHECK(ndr_push_unique_ptr(ndr, r->unix_info));
		NDR_CHECK(ndr_push_uint3264(ndr, NDR_SCALARS, 0));
		/* [ignore] 'torture' */  //:PIDL: Parse::Pidl::Samba4::NDR::Parser::ParseElementPushLevel  lib/Parse/Pidl/Samba4/NDR/Parser.pm:729
		NDR_CHECK(ndr_push_DATA_BLOB(ndr, NDR_SCALARS, r->session_key));  //:PIDL: Parse::Pidl::Samba4::NDR::Parser::ParseDataPush  lib/Parse/Pidl/Samba4/NDR/Parser.pm:604
		NDR_CHECK(ndr_push_uint3264(ndr, NDR_SCALARS, 0));  //:PIDL: Parse::Pidl::Samba4::NDR::Parser::ParsePtrPush  lib/Parse/Pidl/Samba4/NDR/Parser.pm:604
		/* [ignore] 'credentials' */  //:PIDL: Parse::Pidl::Samba4::NDR::Parser::ParseElementPushLevel  lib/Parse/Pidl/Samba4/NDR/Parser.pm:729

The comments starting with '//:PIDL:' have the function name, the filename,
and line number. The comment follows the ordinary output, and uses the '//'
style so as not to interfere with multiline /* */ comments if they happen
to exist.

A '//:PIDL:' comment is added whenever the pidl function or indentation
level changes, and very occasionally at other places if pidl runs for a
while without either of these things happening.

This does not affect pidl parsers that do not inherit from Parse::Pidl::Base,
and is careful to have no performance impact on non-debug generation.

This may help with semi-automated flow analysis.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-12-04 05:10:31 +00:00
Douglas Bagnall
0cb2e6ac4c pidl: add a base class for PIDL parsers
There are about 5 object-oriented parsers, all with their own
effectively identical but differently spelt versions of pidl(),
pidl_hdr(), indent(), and deindent(). With this commit we add a base
class that they can all use.

The ultimate aim is to be able to add some debugging instrumentation
that benefits all[1] the parsers.

[1] The parsers (e.g. Samba::ServerNDR) which use global scope rather
than objects will not be affected.

The versions of the functions in this file follow the most
sophisticated versions of the soon-to-be subclasses. For example, the
pidl() function avoids spurious whitespace and puts #define at column
0, following the Python parser.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-12-04 05:10:31 +00:00
Douglas Bagnall
12cccf3447 pygpo: use correct method flags
The METH_KEYWORDS argument must always be combined with METH_VARARGS.

In Python up to 3.7 this was checked at runtime, and as we had no callers to
get_unix_path() in Python we never noticed. In Python 3.8 it is checked at
import time, and everyone notices even if they aren't directly using GPOs.

Found and reported by Val Kulkov.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14209
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-12-04 05:10:31 +00:00
Andrew Bartlett
d15a3797c7 librpc: Avoid spinning on string_array elements with a short input
Without this protection we will spin during decode of a string_array or nstring_array
that is terminated by only a single NUL byte, not two as required by UTF-16.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13874

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-12-04 05:10:31 +00:00
Gary Lockyer
bf8063e369 librpc ndr: Tests for ndr_pull_string
Tests to ensure that ndr_pull_string handles zero and one byte length
data correctly for both character strings and UTF-16 strings.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13874

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-12-04 05:10:31 +00:00
Gary Lockyer
7127a615cb librpc ndr: Infinite loop parsing Suplemental creds
Fuzzing by Michael Hanselmann found an infinite loop parsing a malformed
supplemental credentials structure.  There are no server-side
network-accessible calls using this code.

This patch adds an ndrdump blackbox test to replicate the issue.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13874

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-12-04 05:10:30 +00:00
Stefan Metzmacher
787adfbcc9 s4:heimdal_build: move krb5-types.h into include/krb5-types.h
source4/heimdal_build/include/ contains public headers,
which are needed by callers.

source4/heimdal_build/*.h should only be used for building the
in tree heimdal itself.

Without this an '#include "replace.h"' can catch 'config.h' from
source4/heimal_build/config.h before bin/default/include/config.h.
This #defines HAVE_CLOSEFROM unconditionally before replace.h can define
the replacement for rep_closefrom() on systems without libbsd.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Dec  3 23:36:17 UTC 2019 on sn-devel-184
2019-12-03 23:36:17 +00:00
Volker Lendecke
1b583bff72 auth3: Remove auth_script
Did this ever really work?

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Dec  2 22:47:24 UTC 2019 on sn-devel-184
2019-12-02 22:47:24 +00:00
Puran Chand
a82ab4a7b3 s3: smbclient doc fix
Signed-off-by: Puran Chand <pchand@vmware.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-12-02 21:23:35 +00:00
Volker Lendecke
77d3a98aa6 smbd: Fix a typo
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-12-02 21:23:35 +00:00
Volker Lendecke
4cd6c87a3d libndr: Fix a talloc context leak
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-12-02 21:23:35 +00:00
Volker Lendecke
8d8d2bdfa4 smbd: Avoid leaking share_entries.tdb records
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-12-02 21:23:35 +00:00
Volker Lendecke
18d7bb0698 smbd: Use share_mode_do_locked() in smbd_do_unlocking()
We don't really need the share mode data here

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-12-02 21:23:35 +00:00
Volker Lendecke
39f9618316 lib: Remove unused smb_xvasprintf()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Martin Schwenke <martins@samba.org>
2019-12-02 21:23:35 +00:00
Volker Lendecke
6d1ce7dc17 winbind: Use vasprintf() in winbindd_cache
Don't need to panic, we can do explicit checks in these few callers

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Martin Schwenke <martins@samba.org>
2019-12-02 21:23:35 +00:00
Volker Lendecke
34c269ad02 lib: Remove a duplicate fdprintf() prototype
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Martin Schwenke <martins@samba.org>
2019-12-02 21:23:35 +00:00
Volker Lendecke
6ab4b87a7e lib: Remove duplicate get_pass() prototypes
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Martin Schwenke <martins@samba.org>
2019-12-02 21:23:34 +00:00
Volker Lendecke
7093356440 lib: Make stdin_new_passwd() static
It's only used in one place

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Martin Schwenke <martins@samba.org>
2019-12-02 21:23:34 +00:00
Uri Simchoni
27fc062d7e heimdal-build: avoid hard-coded /usr/include/heimdal in asn1_compile-generated code.
This fixes a cross-compilation issue, as cross-compilers (rightly)
complain if host include directories are in the include path.

The fix is taken from buildroot (8b11b96f41/package/samba4/0006-heimdal_build-wscript_build-do-not-add-host-include-.patch) where it was applied by Bernd Kuhls <bernd.kuhls@t-online.de>.

This reverts some of 3fe2bfddda, but
building Samba's bundled Heimdal with a system roken is not supported
anyway.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13856

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sun Dec  1 10:22:01 UTC 2019 on sn-devel-184
2019-12-01 10:22:00 +00:00
Michael Hanselmann
7c4341c736 Split winbindd into library and binary
The winbindd program was built in a single target with many source file,
making reuse of parts elsewhere impossible. With this change the
majority of the code is built as a subsystem and included in the binary
as a dependency.

Signed-off-by: Michael Hanselmann <public@hansmi.ch>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-12-01 08:55:39 +00:00
Andrew Bartlett
cddc229a46 selftest: Test partial parse behaviour in ndrdump
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Nov 29 02:09:11 UTC 2019 on sn-devel-184
2019-11-29 02:09:11 +00:00
Andrew Bartlett
b866018c2c ndrdump: Do not run the validate step after a failure
This avoids ending a failed parse with 'dump OK'

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-11-29 00:44:41 +00:00
Andrew Bartlett
ef0257b105 ndrdump: Improve error message when the pipes fail to dump
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-11-29 00:44:40 +00:00
Andrew Bartlett
bbae56411c ndrdump: Show the actual struct/function name in the print, not just what it was called
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-11-29 00:44:40 +00:00
Andrew Bartlett
674d2cfd04 librpc/ndr: Remove unused ndr_cab_generate_checksum()
This function is not just unused, it is a problem because there is no
enforced connection between r->ab.length and r->cbData.

The last caller was removed in the previous commit.

Found by Douglas Bagnall using Hongfuzz and the new fuzz_ndr_X
fuzzer.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-11-29 00:44:40 +00:00
Andrew Bartlett
bd81733bb7 librpc: Make CFDATA private to cab.idl and remove pull and push functions
We can do this because ndr_{pull,push}_CFDATA is unused.

The earlier commit 466d5e8147 removed
the link between "uint16 cbData" and the size of "DATA_BLOB ab" so
when the new ndr_fuzz_X fusser pushed a new structure this allowed
a read beyond the end of allocated memory.

The ndr_push_cab_file() function is also manually written and
does not rely on the value of cbData to calculate the checksum.

Found by Douglas Bagnall using Hongfuzz and the new fuzz_ndr_X
fuzzer, which like ndrdump's struct mode uses the public structure
tables.  (This is how it found the unused functions to test).

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-11-29 00:44:40 +00:00