From: Andrew Bartlett Date: Tue, 19 Nov 2019 04:38:50 +0000 (+1300) Subject: librpc: Do not follow a NULL pointer when calculating the size of a union X-Git-Tag: ldb-2.1.0~261 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=92a7c5a7262cb78fb6307e9168a540154cbe2f71;p=thirdparty%2Fsamba.git librpc: Do not follow a NULL pointer when calculating the size of a union Found by Douglas Bagnall using Hongfuzz and the new fuzz_ndr_X fuzzer. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876 Signed-off-by: Andrew Bartlett Reviewed-by: Gary Lockyer --- diff --git a/librpc/ndr/ndr.c b/librpc/ndr/ndr.c index dc83cf35ffd..4c628c1dae4 100644 --- a/librpc/ndr/ndr.c +++ b/librpc/ndr/ndr.c @@ -1522,6 +1522,11 @@ _PUBLIC_ size_t ndr_size_union(const void *p, int flags, uint32_t level, ndr_pus /* avoid recursion */ if (flags & LIBNDR_FLAG_NO_NDR_SIZE) return 0; + /* Avoid following a NULL pointer */ + if (p == NULL) { + return 0; + } + ndr = ndr_push_init_ctx(NULL); if (!ndr) return 0; ndr->flags |= flags | LIBNDR_FLAG_NO_NDR_SIZE; diff --git a/selftest/knownfail.d/ndrdump-NULL-union b/selftest/knownfail.d/ndrdump-NULL-union deleted file mode 100644 index 64e7e932fd2..00000000000 --- a/selftest/knownfail.d/ndrdump-NULL-union +++ /dev/null @@ -1 +0,0 @@ -^samba.tests.blackbox.ndrdump.samba.tests.blackbox.ndrdump.NdrDumpTests.test_ndrdump_fuzzed_NULL_union_PAC_BUFFER