Andrew Bartlett 7a0ed44b0e ndr: Restrict size of ndr_token lists to avoid memory abuse by malicious clients ...

This is designed to stop a very large number of tokens from being stored for
arrays of structures containing relative pointers in particular.

This was one part of the minimum patch for CVE-2019-14908 before
being downgraded as not a security-release worthy issue.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>

2019-12-12 02:30:39 +00:00

..

libndr.h

ndr: Include the caller location in ndr_{pull,push}_error() messages

2019-11-19 14:47:46 +00:00

ndr_auth.c

auth: Move auth_session_info into IDL

2011-04-05 23:46:04 +02:00

ndr_auth.h

auth: Move auth_session_info into IDL

2011-04-05 23:46:04 +02:00

ndr_backupkey.c

librpc:ndr: Initialize inblob

2018-11-14 05:07:15 +01:00

ndr_backupkey.h

librpc/ndr/ndr_backupkey.h: fix licence/copyright

2011-06-10 15:11:48 +02:00

ndr_basic.c

libndr: Fix a talloc context leak

2019-12-02 21:23:35 +00:00

ndr_bkupblobs.c

idl: add nt backup blobs format

2014-10-02 12:02:01 +02:00

ndr_cab.c

librpc/ndr: Remove unused ndr_cab_generate_checksum()

2019-11-29 00:44:40 +00:00

ndr_cab.h

librpc/ndr: Remove unused ndr_cab_generate_checksum()

2019-11-29 00:44:40 +00:00

ndr_compression.c

librpc/ndr/ndr_compression.c: typo fixes

2019-10-31 00:43:36 +00:00

ndr_compression.h

librpc/ndr: add helper functions to setup and free compression states.

2017-07-19 21:22:13 +02:00

ndr_dcerpc.c

dcerpc.idl: set LIBNDR_FLAG_* flags based on DCERPC_PFC_FLAG_OBJECT_UUID and DCERPC_DREP_LE

2016-10-26 11:20:18 +02:00

ndr_dcerpc.h

dcerpc.idl: hide (ndr->flags & LIBNDR_FLAG_OBJECT_PRESENT) logic behind a define

2014-03-28 08:34:25 +01:00

ndr_dns.c

ndr_dns: fix pushing unknown resource records

2018-01-04 00:37:21 +01:00

ndr_dns.h

librpc/ndr/ndr_dns.h: fix licence/copyright

2011-06-10 15:11:52 +02:00

ndr_dnsp.c

CVE-2016-2123: Fix DNS vuln ZDI-CAN-3995

2016-12-20 07:51:14 +01:00

ndr_dnsp.h

CVE-2016-0771: librpc: add ndr_dnsp_string_list_copy() helper function

2016-03-10 06:52:23 +01:00

ndr_dnsserver.c

ndr: dnsserver: Add pull and push functions for DNS_RPC_RECORD_STRING

2012-03-02 00:24:50 +11:00

ndr_dnsserver.h

s4-dns: Added support for multiple DNS_RPC_RECORDS structures

2011-10-20 05:53:05 +02:00

ndr_drsblobs.c

drsblobs.idl: supplementalCredentialsSubBlob make it possible to parse strange blobs

2016-07-20 21:27:17 +02:00

ndr_drsblobs.h

…

ndr_drsuapi.c

librpc/ndr: Do not follow a client-supplied NULL pointer in _print_drsuapi_DsAttributeValue_attid()

2019-12-10 02:53:34 +00:00

ndr_drsuapi.h

…

ndr_frsrpc.c

…

ndr_frsrpc.h

…

ndr_ioctl.c

librpc: Add NETWORK_INTERFACE_INFO IDL data structure

2014-07-24 19:07:06 +02:00

ndr_krb5pac.c

krb5pac.idl: implement PAC_UPN_DNS_INFO correct

2016-07-20 21:27:18 +02:00

ndr_krb5pac.h

krb5pac: no need for a noprint PAC_BUFFER.

2016-07-20 21:27:18 +02:00

ndr_misc.c

ndr_misc: read syntax_id using strict util_str_hex functions

2018-05-31 01:57:16 +02:00

ndr_nbt.c

librpc/ndr: add ndr_print_netlogon_samlogon_response()

2019-09-26 18:41:26 +00:00

ndr_nbt.h

librpc/ndr: add ndr_print_netlogon_samlogon_response()

2019-09-26 18:41:26 +00:00

ndr_negoex.c

negoex.idl: use DATA_BLOB for negoex_BYTE_VECTOR

2015-12-18 04:07:56 +01:00

ndr_negoex.h

build: Get rid of hardcoded 'bin/default' in includes

2019-02-08 08:51:19 +01:00

ndr_netlogon.c

…

ndr_netlogon.h

…

ndr_ntlmssp.c

librpc/ndr: add ndr_ntlmssp_find_av() helper function

2016-03-10 06:52:29 +01:00

ndr_ntlmssp.h

librpc/ndr: add ndr_ntlmssp_find_av() helper function

2016-03-10 06:52:29 +01:00

ndr_ntprinting.c

ndr: Pass down string_flags in ndr_pull_ntprinting_printer().

2013-03-15 12:11:03 +01:00

ndr_ntprinting.h

ndr: Add ndr_ntprinting_string_flags() function.

2013-03-15 12:11:02 +01:00

ndr_orpc.c

ndr_orpc: properly allocate empty DUALSTRINGARRAY

2019-11-20 04:41:28 +00:00

ndr_preg.c

librpc: move preg.idl to main directory.

2011-02-10 13:56:49 +01:00

ndr_preg.h

librpc: move preg.idl to main directory.

2011-02-10 13:56:49 +01:00

ndr_rap.c

…

ndr_rap.h

…

ndr_schannel.c

…

ndr_schannel.h

…

ndr_sec_helper.c

Spelling fixes s/ upto / up to /

2019-09-01 22:21:27 +00:00

ndr_spoolss_buf.c

ndr_spoolss_buf: fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT()

2019-03-06 03:16:14 +00:00

ndr_spoolss_buf.h

spoolss: rename spoolss_EnumPrintProcDataTypes to spoolss_EnumPrintProcessorDataTypes

2016-09-22 12:29:26 +02:00

ndr_string.c

librpc: Avoid spinning on string_array elements with a short input

2019-12-04 05:10:31 +00:00

ndr_svcctl.c

…

ndr_svcctl.h

…

ndr_table.c

librpc: Do not return an NDR table for a zero GUID

2019-11-14 08:01:43 +00:00

ndr_table.h

librpc/ndr: add ndr_table_by_syntax()

2014-02-11 16:20:28 +01:00

ndr_witness.c

librpc:ndr:witness: remove an unneeded block, reducing indentation.

2015-07-07 23:37:04 +02:00

ndr_witness.h

witness: autogenerate the marshalling of the witness_notifyResponse_message.

2015-07-03 02:00:27 +02:00

ndr_wmi.c

librpc: fix buildwarning in NDR_WMI.

2011-06-15 17:23:48 +02:00

ndr_wmi.h

librpc: fix buildwarning in NDR_WMI.

2011-06-15 17:23:48 +02:00

ndr_xattr.c

…

ndr_xattr.h

…

ndr.c

ndr: Restrict size of ndr_token lists to avoid memory abuse by malicious clients

2019-12-12 02:30:39 +00:00

util.c

librpc:ndr: Implement ndr_zero_memory()

2019-02-14 15:59:25 +01:00

uuid.c

ndr: Init variables of GUID_from_data_blob()

2018-10-19 23:11:26 +02:00