librpc/ndr: Do not follow a client-supplied NULL pointer in _print_drsuapi_DsAttribut...

This is not a security issue as it only happens when printing the structure
during debugging, not normal production.

Found by Michael Hanselmann using an NDR fuzzer and Hongfuzz.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

diff --git a/librpc/ndr/ndr_drsuapi.c b/librpc/ndr/ndr_drsuapi.c
index 45d3ac095c3eb3734dacb89a97ac37c60014b219..cd550f1f0ee39d337d79145375c1b7119131932d 100644 (file)
--- a/librpc/ndr/ndr_drsuapi.c
+++ b/librpc/ndr/ndr_drsuapi.c
@@ -94,8 +94,14 @@ static void _print_drsuapi_DsAttributeValue_attid(struct ndr_print *ndr, const c
 
        ndr_print_struct(ndr, name, "drsuapi_DsAttributeValue");
        ndr->depth++;
-       v = IVAL(r->blob->data, 0);
-       ndr_print_uint32(ndr, "attid", v);
+       if (r->blob == NULL || r->blob->data == NULL) {
+               ndr_print_string(ndr, "attid", "NULL");
+       } else if (r->blob->length < 4) {
+               ndr_print_DATA_BLOB(ndr, "attid", *r->blob);
+       } else {
+               v = IVAL(r->blob->data, 0);
+               ndr_print_uint32(ndr, "attid", v);
+       }
        ndr->depth--;
 }
 

diff --git a/selftest/knownfail.d/ndrdump-drsuapi b/selftest/knownfail.d/ndrdump-drsuapi
deleted file mode 100644 (file)
index 858380d..0000000
--- a/selftest/knownfail.d/ndrdump-drsuapi
+++ /dev/null
@@ -1,2 +0,0 @@
-^samba.tests.blackbox.ndrdump.samba.tests.blackbox.ndrdump.NdrDumpTests.test_ndrdump_fuzzed_drsuapi_DsAddEntry_1
-^samba.tests.blackbox.ndrdump.samba.tests.blackbox.ndrdump.NdrDumpTests.test_ndrdump_fuzzed_drsuapi_DsReplicaAttribute