From: Martin Schwenke Date: Tue, 9 Jun 2026 11:48:02 +0000 (+1000) Subject: CVE-2026-58224: ctdb-protocol: Avoid off-by-one error for bytes pulled X-Git-Tag: talloc-2.5.0~17 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=aa7d65bc979f879e00871750efe57702ae7e1b2f;p=thirdparty%2Fsamba.git CVE-2026-58224: ctdb-protocol: Avoid off-by-one error for bytes pulled As per the comment, if there is no NUL byte in the buffer then don't count one in the number of bytes pulled. Note that this is unlikely to be a security issue because it would take a protocol bug elsewhere to overrun the buffer. However, include this fix here for posterity. BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085 Reported-by: Andrew Tridgell (issue 16) Signed-off-by: Martin Schwenke Reviewed-by: Tristan Madani Reviewed-by: Stefan Metzmacher --- diff --git a/ctdb/protocol/protocol_basic.c b/ctdb/protocol/protocol_basic.c index 42f207790d0..9cc52def644 100644 --- a/ctdb/protocol/protocol_basic.c +++ b/ctdb/protocol/protocol_basic.c @@ -247,7 +247,8 @@ void ctdb_string_push(const char **in, uint8_t *buf, size_t *npush) int ctdb_string_pull(uint8_t *buf, size_t buflen, TALLOC_CTX *mem_ctx, const char **out, size_t *npull) { - const char *str; + const char *str = NULL; + size_t len = 0; if (buflen > UINT32_MAX) { return EMSGSIZE; @@ -265,7 +266,14 @@ int ctdb_string_pull(uint8_t *buf, size_t buflen, TALLOC_CTX *mem_ctx, } *out = str; - *npull = ctdb_string_len(&str); + /* + * Avoid claiming to have consumed more than buflen. + * ctdb_string_len() returns buflen + 1 if there is no + * NUL-terminator within buflen, so no NUL was actually + * consumed (so no +1 needed). + */ + len = ctdb_string_len(&str); + *npull = MIN(buflen, len); return 0; }