1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-22 13:34:15 +03:00
samba-mirror/librpc
Douglas Bagnall 6fb98f70c6 ndr: always attempt ACE coda pull if ACE type suggests a coda
We were skipping the pull in cases where the coda size was calculated
to be zero. This has the right result for empty conditional ACEs, but
not for Resource Attribute ACEs where the
CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 coda was not intialised.

The situation is made a bit worse, because the function that
calculates the coda size (ndr_subcontext_size_of_ace_coda()) can
return zero in conditions that are not exactly errors, but in which
the would-be calculated value makes so little sense that zero is
thought to be a safer default.

Credit to OSS-Fuzz.

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66577
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15613

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Mar 25 06:00:21 UTC 2024 on atb-devel-224
2024-03-25 06:00:21 +00:00
..
ABI lib: Make GUID_to_ndr_buf() return void 2024-03-12 13:31:31 +00:00
gen_ndr
idl libcli/security: Add SID_FRESH_PUBLIC_KEY_IDENTITY 2024-02-28 03:44:37 +00:00
ndr ndr: always attempt ACE coda pull if ACE type suggests a coda 2024-03-25 06:00:21 +00:00
rpc dcesrv_reply: just drop responses if the connection is already terminating 2024-01-09 11:26:55 +00:00
tests librpc: Change type of ‘u16string’ from ‘const uint16_t *’ to ‘const unsigned char *’ 2023-12-21 23:48:46 +00:00
tools tools: Fix whitespace 2024-03-12 13:31:31 +00:00
wsp librpc/wsp: Unknown property used in 'current directory' searches 2024-01-30 16:21:35 +00:00
binding-strings.txt
ndr_krb5pac.pc.in
ndr_nbt.pc.in
ndr_standard.pc.in
ndr.pc.in
tables.pl
wscript_build lib: Make GUID_to_ndr_buf() return void 2024-03-12 13:31:31 +00:00