From: Andrew Bartlett Date: Thu, 19 Dec 2019 21:50:09 +0000 (+1300) Subject: librpc: Do not access name[-1] trying to push "" into a dnsp_name X-Git-Tag: ldb-2.1.0~188 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a85d257c1ec3a4505f2a4fcbec0f7e1f60dbff91;p=thirdparty%2Fsamba.git librpc: Do not access name[-1] trying to push "" into a dnsp_name This simply matches the behaviour from before e7b1acaddf2ccc7de0301cc67f72187ab450e7b5 when the logic for a trailing . was added. This matches what is added in the dnsRecord attribute for a name of "." over the dnsserver RPC management interface and is based on what Windows does for that name in (eg) an MX record. No a security bug because we use talloc and so name will be just the end of the talloc header. Credit to OSS-Fuzz Found using the fuzz_ndr_X fuzzer Signed-off-by: Andrew Bartlett Reviewed-by: Ralph Boehme Autobuild-User(master): Ralph Böhme Autobuild-Date(master): Fri Dec 20 11:33:52 UTC 2019 on sn-devel-184 --- diff --git a/librpc/ndr/ndr_dnsp.c b/librpc/ndr/ndr_dnsp.c index 974ff5ebff2..d75c58fca37 100644 --- a/librpc/ndr/ndr_dnsp.c +++ b/librpc/ndr/ndr_dnsp.c @@ -106,8 +106,18 @@ enum ndr_err_code ndr_push_dnsp_name(struct ndr_push *ndr, int ndr_flags, const } total_len = strlen(name) + 1; - /* cope with names ending in '.' */ - if (name[strlen(name)-1] != '.') { + /* + * cope with names ending in '.' + */ + if (name[0] == '\0') { + /* + * Don't access name[-1] for the "" input, which has + * the same meaning as a lone '.'. + * + * This allows a round-trip of a dnsRecord from + * Windows of a MX record of '.' + */ + } else if (name[strlen(name)-1] != '.') { total_len++; count++; } diff --git a/selftest/knownfail.d/ndrdump-dnsp_name b/selftest/knownfail.d/ndrdump-dnsp_name deleted file mode 100644 index c4565998cf2..00000000000 --- a/selftest/knownfail.d/ndrdump-dnsp_name +++ /dev/null @@ -1 +0,0 @@ -^samba.tests.blackbox.ndrdump.samba.tests.blackbox.ndrdump.NdrDumpTests.test_ndrdump_dnsp_DnssrvRpcRecord