9 Commits

Author	SHA1	Message	Date
Douglas Bagnall	fc83b47051	libprc/test: add pull_string_array large array test ... Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Fri Aug 7 04:44:17 UTC 2020 on sn-devel-184	2020-08-07 04:44:17 +00:00
Douglas Bagnall	bc896d7529	CVE-2020-10745: librpc/tests: cmocka tests of dns and ndr strings ... These time the push and pull function in isolation. Timing should be under 0.0001 seconds on even quite old hardware; we assert it must be under 0.2 seconds. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14378 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>	2020-07-02 09:01:41 +00:00
Stefan Metzmacher	cefa9be9d7	librpc/tests: make use of replace.h in test_ndr*.c ... This fixes the build on FreeBSD 12.1 and maybe other systems. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2020-03-27 09:02:37 +00:00
Gary Lockyer	ba518a1deb	librpc ndr: add recursion check macros ... Add macros to check the recursion depth. Credit to OSS-Fuzz REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19280 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14254 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>	2020-02-27 01:02:32 +00:00
Gary Lockyer	d1277f4d02	librpc ndr tests: Unsigned overflow in ndr_pull_advance ... Check that uint32 overflow is handled correctly by ndr_pull_advance. Credit to OSS-Fuzz REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20083 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14236 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>	2020-02-07 08:53:40 +00:00
Gary Lockyer	46edde8647	librpc ndr tests: uint32 overflow in NDR_PULL_ALIGN ... Check that uint32 overflow is handled correctly by NDR_NEED_BYTES. Credit to OSS-Fuzz REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20083 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14236 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>	2020-02-07 08:53:40 +00:00
Gary Lockyer	ae6927e4f0	librpc ndr: Heap-buffer-overflow in lzxpress_decompress ... Reproducer for oss-fuzz Issue 20083 Project: samba Fuzzing Engine: libFuzzer Fuzz Target: fuzz_ndr_drsuapi_TYPE_OUT Job Type: libfuzzer_asan_samba Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6040000002fd Crash State: lzxpress_decompress ndr_pull_compression_xpress_chunk ndr_pull_compression_start Sanitizer: address (ASAN) Recommended Security Severity: Medium Credit to OSS-Fuzz REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20083 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14236 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>	2020-02-07 08:53:40 +00:00
Andreas Schneider	b28d1dca86	librpc: Add test for ndr_string_length() ... Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri Dec 20 09:01:30 UTC 2019 on sn-devel-184	2019-12-20 09:01:30 +00:00
Gary Lockyer	bf8063e369	librpc ndr: Tests for ndr_pull_string ... Tests to ensure that ndr_pull_string handles zero and one byte length data correctly for both character strings and UTF-16 strings. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13874 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>	2019-12-04 05:10:31 +00:00