From: Andrew Bartlett Date: Wed, 4 Dec 2019 20:56:44 +0000 (+1300) Subject: librpc/ndr: Do not follow a client-supplied NULL pointer in _print_drsuapi_DsAttribut... X-Git-Tag: ldb-2.1.0~339 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b6913830bf626c8d7059f4cda3a4fc1bb3081973;p=thirdparty%2Fsamba.git librpc/ndr: Do not follow a client-supplied NULL pointer in _print_drsuapi_DsAttributeValue_attid() This is not a security issue as it only happens when printing the structure during debugging, not normal production. Found by Michael Hanselmann using an NDR fuzzer and Hongfuzz. Signed-off-by: Andrew Bartlett Reviewed-by: Douglas Bagnall --- diff --git a/librpc/ndr/ndr_drsuapi.c b/librpc/ndr/ndr_drsuapi.c index 45d3ac095c3..cd550f1f0ee 100644 --- a/librpc/ndr/ndr_drsuapi.c +++ b/librpc/ndr/ndr_drsuapi.c @@ -94,8 +94,14 @@ static void _print_drsuapi_DsAttributeValue_attid(struct ndr_print *ndr, const c ndr_print_struct(ndr, name, "drsuapi_DsAttributeValue"); ndr->depth++; - v = IVAL(r->blob->data, 0); - ndr_print_uint32(ndr, "attid", v); + if (r->blob == NULL || r->blob->data == NULL) { + ndr_print_string(ndr, "attid", "NULL"); + } else if (r->blob->length < 4) { + ndr_print_DATA_BLOB(ndr, "attid", *r->blob); + } else { + v = IVAL(r->blob->data, 0); + ndr_print_uint32(ndr, "attid", v); + } ndr->depth--; } diff --git a/selftest/knownfail.d/ndrdump-drsuapi b/selftest/knownfail.d/ndrdump-drsuapi deleted file mode 100644 index 858380dea76..00000000000 --- a/selftest/knownfail.d/ndrdump-drsuapi +++ /dev/null @@ -1,2 +0,0 @@ -^samba.tests.blackbox.ndrdump.samba.tests.blackbox.ndrdump.NdrDumpTests.test_ndrdump_fuzzed_drsuapi_DsAddEntry_1 -^samba.tests.blackbox.ndrdump.samba.tests.blackbox.ndrdump.NdrDumpTests.test_ndrdump_fuzzed_drsuapi_DsReplicaAttribute