From: Martin Schwenke <mschwenke@ddn.com>
Date: Sun, 31 May 2026 05:11:39 +0000 (+1000)
Subject: CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
X-Git-Tag: talloc-2.5.0~19
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0c3001b7dc1e29d42dad135fac734c9a71bfa896;p=thirdparty%2Fsamba.git

CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access

The first check is clearly needed because m->db_id is referenced.  The
second check is handled by a similar update to
ctdb_control_update_record(), but repeat it in case something else
changes.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
---

diff --git a/ctdb/server/ctdb_persistent.c b/ctdb/server/ctdb_persistent.c
index 26717441d17..1b0d1411553 100644
--- a/ctdb/server/ctdb_persistent.c
+++ b/ctdb/server/ctdb_persistent.c
@@ -182,6 +182,16 @@ int32_t ctdb_control_trans3_commit(struct ctdb_context *ctdb,
 	struct ctdb_marshall_buffer *m = (struct ctdb_marshall_buffer *)recdata.dptr;
 	struct ctdb_db_context *ctdb_db;
 
+	if (recdata.dsize < offsetof(struct ctdb_marshall_buffer, data)) {
+		DBG_ERR("Invalid packet\n");
+		return -1;
+	}
+	if (m->count >
+	    recdata.dsize - offsetof(struct ctdb_marshall_buffer, data)) {
+		DBG_ERR("Invalid packet\n");
+		return -1;
+	}
+
 	if (ctdb->recovery_mode != CTDB_RECOVERY_NORMAL) {
 		DEBUG(DEBUG_INFO,("rejecting ctdb_control_trans3_commit when recovery active\n"));
 		return -1;