CVE-2020-10704 libcli ldap: Check search request lengths.

Check the search request lengths against the limits passed to
ldap_decode.

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/lib/util/asn1.c b/lib/util/asn1.c
index def71585d3847db2350e1dfe96522844e9d71e3a..03d417d8104c7de0c902f1331e2c6157eb19c5d3 100644 (file)
--- a/lib/util/asn1.c
+++ b/lib/util/asn1.c
@@ -1152,3 +1152,10 @@ int asn1_peek_full_tag(DATA_BLOB blob, uint8_t tag, size_t *packet_size)
        *packet_size = size;
        return 0;
 }
+
+/*
+ * Get the length of the ASN.1 data
+ */
+size_t asn1_get_length(const struct asn1_data *asn1) {
+       return asn1->length;
+}

diff --git a/lib/util/asn1.h b/lib/util/asn1.h
index fc365724e936e89678b6d753ae5c18aa66fc7452..de92a767f14c3ea8a2571a751efc33277f4b6410 100644 (file)
--- a/lib/util/asn1.h
+++ b/lib/util/asn1.h
@@ -106,5 +106,6 @@ bool asn1_extract_blob(struct asn1_data *asn1, TALLOC_CTX *mem_ctx,
                       DATA_BLOB *pblob);
 void asn1_load_nocopy(struct asn1_data *data, uint8_t *buf, size_t len);
 int asn1_peek_full_tag(DATA_BLOB blob, uint8_t tag, size_t *packet_size);
+size_t asn1_get_length(const struct asn1_data *asn1);
 
 #endif /* _ASN_1_H */

diff --git a/libcli/ldap/ldap_message.c b/libcli/ldap/ldap_message.c
index d38fa0b3b615db7b2630135199ffedb7425cf299..69a482795326661fe4bd4dc6214094f1db122cca 100644 (file)
--- a/libcli/ldap/ldap_message.c
+++ b/libcli/ldap/ldap_message.c
@@ -1259,7 +1259,11 @@ _PUBLIC_ NTSTATUS ldap_decode(struct asn1_data *data,
                struct ldap_SearchRequest *r = &msg->r.SearchRequest;
                int sizelimit, timelimit;
                const char **attrs = NULL;
+               size_t request_size = asn1_get_length(data);
                msg->type = LDAP_TAG_SearchRequest;
+               if (request_size > limits->max_search_size) {
+                       goto prot_err;
+               }
                if (!asn1_start_tag(data, tag)) goto prot_err;
                if (!asn1_read_OctetString_talloc(msg, data, &r->basedn)) goto prot_err;
                if (!asn1_read_enumerated(data, (int *)(void *)&(r->scope))) goto prot_err;