From: Andrew Bartlett <abartlet@samba.org>
Date: Wed, 4 Dec 2019 03:56:44 +0000 (+1300)
Subject: selftest: Add test for ndr_size_struct() faulting on a NULL pointer
X-Git-Tag: ldb-2.1.0~273
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bcffdc9a895c8aa572819ddd4fca451038990402;p=thirdparty%2Fsamba.git

selftest: Add test for ndr_size_struct() faulting on a NULL pointer

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
---

diff --git a/python/samba/tests/blackbox/ndrdump.py b/python/samba/tests/blackbox/ndrdump.py
index 7e42fbef1c5..834e0fde966 100644
--- a/python/samba/tests/blackbox/ndrdump.py
+++ b/python/samba/tests/blackbox/ndrdump.py
@@ -398,3 +398,16 @@ dump OK
             self.fail(e)
 
         self.assertEqual(actual, expected)
+
+    # Test a --validate push of a NULL struct pointer
+    def test_ndrdump_fuzzed_NULL_struct_ntlmssp_CHALLENGE_MESSAGE(self):
+        expected =  open(self.data_path("fuzzed_ntlmssp-CHALLENGE_MESSAGE.txt")).read().encode('utf8')
+        try:
+            actual = self.check_exit_code(
+                "ndrdump ntlmssp CHALLENGE_MESSAGE struct --validate --input " +\
+                "'AAAACwIAAAAAJwIAAAAAAAcAAAAAAAAAAIAbhG8uyk9dAL0mQE73MAAAAAAAAAAA' --base64-input",
+                1)
+        except BlackboxProcessError as e:
+            self.fail(e)
+
+        self.assertEqual(actual, expected)
diff --git a/selftest/knownfail.d/ndrdump-NULL-struct b/selftest/knownfail.d/ndrdump-NULL-struct
new file mode 100644
index 00000000000..8131b070b37
--- /dev/null
+++ b/selftest/knownfail.d/ndrdump-NULL-struct
@@ -0,0 +1 @@
+^samba.tests.blackbox.ndrdump.samba.tests.blackbox.ndrdump.NdrDumpTests.test_ndrdump_fuzzed_NULL_struct_ntlmssp_CHALLENGE_MESSAGE
diff --git a/source4/librpc/tests/fuzzed_ntlmssp-CHALLENGE_MESSAGE.txt b/source4/librpc/tests/fuzzed_ntlmssp-CHALLENGE_MESSAGE.txt
new file mode 100644
index 00000000000..f489979d173
--- /dev/null
+++ b/source4/librpc/tests/fuzzed_ntlmssp-CHALLENGE_MESSAGE.txt
@@ -0,0 +1,43 @@
+pull returned Success
+    CHALLENGE_MESSAGE: struct CHALLENGE_MESSAGE
+        Signature                : ''
+        MessageType              : UNKNOWN_ENUM_VALUE (0x22700)
+        TargetNameLen            : 0x0000 (0)
+        TargetNameMaxLen         : 0x0000 (0)
+        TargetName               : *
+            TargetName               : ''
+        NegotiateFlags           : 0x00000000 (0)
+               0: NTLMSSP_NEGOTIATE_UNICODE
+               0: NTLMSSP_NEGOTIATE_OEM    
+               0: NTLMSSP_REQUEST_TARGET   
+               0: NTLMSSP_NEGOTIATE_SIGN   
+               0: NTLMSSP_NEGOTIATE_SEAL   
+               0: NTLMSSP_NEGOTIATE_DATAGRAM
+               0: NTLMSSP_NEGOTIATE_LM_KEY 
+               0: NTLMSSP_NEGOTIATE_NETWARE
+               0: NTLMSSP_NEGOTIATE_NTLM   
+               0: NTLMSSP_NEGOTIATE_NT_ONLY
+               0: NTLMSSP_ANONYMOUS        
+               0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED
+               0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED
+               0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL
+               0: NTLMSSP_NEGOTIATE_ALWAYS_SIGN
+               0: NTLMSSP_TARGET_TYPE_DOMAIN
+               0: NTLMSSP_TARGET_TYPE_SERVER
+               0: NTLMSSP_TARGET_TYPE_SHARE
+               0: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY
+               0: NTLMSSP_NEGOTIATE_IDENTIFY
+               0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY
+               0: NTLMSSP_NEGOTIATE_TARGET_INFO
+               0: NTLMSSP_NEGOTIATE_VERSION
+               0: NTLMSSP_NEGOTIATE_128    
+               0: NTLMSSP_NEGOTIATE_KEY_EXCH
+               0: NTLMSSP_NEGOTIATE_56     
+        ServerChallenge          : 00801b846f2eca4f
+        Reserved                 : 5d00bd26404ef730
+        TargetInfoLen            : 0x0000 (0)
+        TargetInfoMaxLen         : 0x0000 (0)
+        TargetInfo               : NULL
+ndr_push_subcontext_end: ndr_push_error(Subcontext Error): Bad subcontext (PUSH) content_size 1 is larger than size_is(0) at ../../librpc/ndr/ndr.c:905
+push returned Subcontext Error
+validate push FAILED