mirror of
https://github.com/samba-team/samba.git
synced 2024-12-24 21:34:56 +03:00
dd896862d0
mdscli_ctx->mdscmd_open.share_path is an array of size 1025. The
boundary is 1025 and not UINT16_MAX.
"Error: OVERRUN (CWE-119):
samba-4.20.0rc2/source3/rpc_client/cli_mdssvc.c:127: cond_at_least: Checking ""share_path_len < 1UL"" implies that ""share_path_len"" is at least 1 on the false branch.
samba-4.20.0rc2/source3/rpc_client/cli_mdssvc.c:127: cond_between: Checking ""share_path_len > 65535UL"" implies that ""share_path_len"" is between 1 and 65535 (inclusive) on the false branch.
samba-4.20.0rc2/source3/rpc_client/cli_mdssvc.c:133: overrun-local: Overrunning array ""mdscli_ctx->mdscmd_open.share_path"" of 1025 bytes at byte offset 65534 using index ""share_path_len - 1UL"" (which evaluates to 65534).
131| mdscli_ctx->mdscmd_open.share_path_len = share_path_len;
132|
133|-> if (mdscli_ctx->mdscmd_open.share_path[share_path_len-1] == '/') {
134| mdscli_ctx->mdscmd_open.share_path[share_path_len-1] = '\0';
135| mdscli_ctx->mdscmd_open.share_path_len--;"
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
|
||
|---|---|---|
| .. | ||
| cli_lsarpc.c | ||
| cli_lsarpc.h | ||
| cli_mdssvc_private.h | ||
| cli_mdssvc_util.c | ||
| cli_mdssvc_util.h | ||
| cli_mdssvc.c | ||
| cli_mdssvc.h | ||
| cli_netlogon.c | ||
| cli_netlogon.h | ||
| cli_pipe_schannel.c | ||
| cli_pipe.c | ||
| cli_pipe.h | ||
| cli_samr.c | ||
| cli_samr.h | ||
| cli_spoolss.c | ||
| cli_spoolss.h | ||
| cli_winreg_int.c | ||
| cli_winreg_int.h | ||
| cli_winreg_spoolss.c | ||
| cli_winreg_spoolss.h | ||
| cli_winreg.c | ||
| cli_winreg.h | ||
| init_lsa.c | ||
| init_lsa.h | ||
| init_samr.c | ||
| init_samr.h | ||
| init_spoolss.c | ||
| init_spoolss.h | ||
| local_np.c | ||
| local_np.h | ||
| py_mdscli.c | ||
| rpc_client.h | ||
| rpc_transport_np.c | ||
| rpc_transport_sock.c | ||
| rpc_transport_tstream.c | ||
| rpc_transport.h | ||
| util_netlogon.c | ||
| util_netlogon.h | ||
| wsp_cli.c | ||
| wsp_cli.h | ||