1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-10 01:18:15 +03:00
samba-mirror/librpc/rpc
Douglas Bagnall 302098c325 rpc: avoid undefined behaviour when parsing bindings
If the binding string ends with "[", we were setting options to an
empty string, then asking for 'options[strlen(options)-1]', which
UBSan dosn't like because the offset evaluates to (size_t)0xFFFFF...
causing pointer overflow.

I believe this is actually well defined in practice, but we don't want
to be in the habit of leaving sanitiser warnings in code parsing
untrusted strings.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-10-23 03:25:35 +00:00
..
binding_handle.c librpc/rpc: verify the passed table against the table on the handle 2016-10-26 11:20:18 +02:00
binding.c rpc: avoid undefined behaviour when parsing bindings 2020-10-23 03:25:35 +00:00
dcerpc_error.c librpc:rpc: Use C99 initializer for last element in dcerpc_faults 2019-01-28 10:29:23 +01:00
dcerpc_util.c lib/util: remove extra safe_string.h file 2020-08-28 02:18:40 +00:00
dcesrv_auth.c s4:rpc_server: Move core functions to core library 2019-10-18 16:07:37 +00:00
dcesrv_core.c lib/util: remove extra safe_string.h file 2020-08-28 02:18:40 +00:00
dcesrv_core.h s3:rpc_server: Improve local dispatching 2020-04-08 22:23:05 +00:00
dcesrv_handles.c librpc: core: Move the s4 handles implementation to the RPC server core 2020-05-24 23:55:36 +00:00
dcesrv_mgmt.c librpc:core: Allocate struct dcesrv_interface with talloc 2019-10-18 16:07:37 +00:00
dcesrv_reply.c dcerpc: developer option to save ndr_fuzz_X seeds 2019-12-10 07:50:28 +00:00
rpc_common.h dcerpc: developer option to save ndr_fuzz_X seeds 2019-12-10 07:50:28 +00:00