mirror of
https://github.com/samba-team/samba.git
synced 2025-01-07 17:18:11 +03:00
22dd9072c9
If len_len is equal to total_len - 1 (i.e. the input consists only of a 0x60 byte and a length), the expression 'total_len - 1 - len_len - 1', used as the 'len' parameter to der_get_length(), will overflow to SIZE_MAX. Then der_get_length() will proceed to read, unconstrained, whatever data follows in memory. Add a check to ensure that doesn't happen. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15134 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> |
||
|---|---|---|
| .. | ||
| bug-14236 | ||
| complex_expressions | ||
| dns | ||
| dns_packet | ||
| dns-aging | ||
| durable-v2-delay | ||
| empty-domain-name | ||
| encrypted_secrets | ||
| getncchanges | ||
| heimdal-des-overflow | ||
| initshutdown | ||
| kdc-salt | ||
| keytab | ||
| kinit_trust | ||
| krb5-no-preauth | ||
| labdc | ||
| ldap | ||
| ldap_spn | ||
| modify-order | ||
| multichannel | ||
| netlogon | ||
| ntlmv1-restrictions | ||
| ntlmv2-restrictions | ||
| oneway | ||
| password_settings | ||
| priv_attr | ||
| python-segfaults | ||
| quota1 | ||
| README | ||
| replica_sync | ||
| rpc-netlogon-zerologon | ||
| rw-invalid | ||
| s3-lsa-server | ||
| samba3.vfs.fruit | ||
| smb1-tests | ||
| smb2.replay | ||
| smb2.session | ||
| smbcacls | ||
| smbclient-smb3 | ||
| source3-epmapper | ||
| srvsvc | ||
| uac_objectclass_restrict | ||
| upn_handling | ||
| usage | ||
| vlv | ||
| wkssvc | ||
# Files in this directory contain lists of regular expressions # matching the names of tests that are temporarily expected to fail. # # "make test" will not report failures for tests listed here and will consider # a successful run for any of these tests an error. # # Empty lines and lines beginning with '#' are ignored. # Please don't add tests to this README!