libcli/security: sddl_decode_access rejects trailing rubbish

Before we just ignored things like negative numbers, because they'd
end up being seen as not-numbers, so treated as flags, then as
not-flags.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/libcli/security/sddl.c b/libcli/security/sddl.c
index b115d893e72111a9bb76fc81f6154c3d2bb24048..a726c06ddafdbed6ed2b4dfede65ba8e642eb837 100644 (file)
--- a/libcli/security/sddl.c
+++ b/libcli/security/sddl.c
@@ -369,7 +369,11 @@ static bool sddl_decode_access(const char *str, uint32_t *pmask)
                         * and the shortest 64-bit wrapping string is
                         * 19 (for "0x1" + 16 zeros).
                         */
-                       DBG_WARNING("Bad numeric flag value in %s\n", str0);
+                       DBG_WARNING("Bad numeric flag value in '%s'\n", str0);
+                       return false;
+               }
+               if (*end != '\0') {
+                       DBG_WARNING("Bad characters in '%s'\n", str0);
                        return false;
                }
                *pmask = numeric_mask;
@@ -393,7 +397,10 @@ static bool sddl_decode_access(const char *str, uint32_t *pmask)
                mask |= flags;
                str += len;
        }
-
+        if (*str != '\0') {
+               DBG_WARNING("Bad characters in '%s'\n", str0);
+                return false;
+        }
        *pmask = mask;
        return true;
 }

diff --git a/selftest/knownfail.d/sddl b/selftest/knownfail.d/sddl
index 30fa1f85275963d88a36407f39aec7a613f71569..8e5a13fc24fd66eaaebcc75ed7900070ac440e5a 100644 (file)
--- a/selftest/knownfail.d/sddl
+++ b/selftest/knownfail.d/sddl
@@ -1,16 +1,5 @@
-^samba.tests.sddl.+.SddlShouldFail.test_sddl_should_fail_D:.A;;0x.75bcd15;;;LG..none
-^samba.tests.sddl.+.SddlShouldFail.test_sddl_should_fail_D:.A;;0x75bcd15       ;;;LG..none
-^samba.tests.sddl.+.SddlShouldFail.test_sddl_should_fail_D:.A;;123456789.;;;LG..none
-^samba.tests.sddl.+.SddlShouldFail.test_sddl_should_fail_D:.A;;GA.;;;LG..none
 ^samba.tests.sddl.+.SddlShouldFail.test_sddl_should_fail_D:.A;;GA;;;S-1-3-4...none
-^samba.tests.sddl.+.SddlShouldFail.test_sddl_should_fail_D:.A;;RP.;;;LG..none
 ^samba.tests.sddl.+.SddlWindowsFlagsAreDifferent.test_sddl_D:.A;;0x001f01ff;;;WD..A;;0x001f01ff;;;S-1.+S
 ^samba.tests.sddl.+.SddlWindowsFlagsAreDifferent.test_sddl_D:.A;;FA;;;WD..none
 ^samba.tests.sddl.+.SddlWindowsFlagsAreDifferent.test_sddl_O:S-1-5-21-2212615479-2695158682-210137546.+:
-^samba.tests.sddl.+.SddlWindowsIsLessFussy.test_sddl_should_fail_D:.A;;.GA;;;LG..none
 ^samba.tests.sddl.+.SddlWindowsIsLessFussy.test_sddl_should_fail_D:.A;;GA;;;WD...none
-^samba.tests.sddl.+.SddlWindowsIsLessFussy.test_sddl_should_fail_D:.A;;ga;;;LG..none
-^samba.tests.sddl.+.SddlWindowsIsWeird.test_sddl_should_fail_D:.A;;-0xffffff55;;;LG..none
-^samba.tests.sddl.+.SddlWindowsIsWeird.test_sddl_should_fail_D:.A;;-9876543210;;;LG..none
-^samba.tests.sddl.+.SddlWindowsIsWeird.test_sddl_should_fail_D:.A;;-99;;;LG..none
-^samba.tests.sddl.+.SddlWindowsIsWeird.test_sddl_should_fail_D:.A;;100000000000000000000000;;;LG..none