From: Andrew Bartlett Date: Wed, 4 Dec 2019 03:49:13 +0000 (+1300) Subject: selftest: Add test for ndr_size_union() faulting on a NULL pointer X-Git-Tag: ldb-2.1.0~274 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f56fa3bb6a0e2275114a6f4dd27640af1e15018b;p=thirdparty%2Fsamba.git selftest: Add test for ndr_size_union() faulting on a NULL pointer BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876 Signed-off-by: Andrew Bartlett Reviewed-by: Gary Lockyer --- diff --git a/python/samba/tests/blackbox/ndrdump.py b/python/samba/tests/blackbox/ndrdump.py index a1528d86485..7e42fbef1c5 100644 --- a/python/samba/tests/blackbox/ndrdump.py +++ b/python/samba/tests/blackbox/ndrdump.py @@ -367,3 +367,34 @@ dump OK self.assertEqual(actual[:len(expected_head)], expected_head) self.assertTrue(actual.endswith(expected_tail)) + + # Test a --validate push of a NULL union pointer + def test_ndrdump_fuzzed_NULL_union_PAC_BUFFER(self): + expected = b'''pull returned Success +WARNING! 13 unread bytes +[0000] F5 FF 00 3C 3C 25 FF 70 16 1F A0 12 84 ...<<%.p ..... + PAC_BUFFER: struct PAC_BUFFER + type : UNKNOWN_ENUM_VALUE (1094251328) + _ndr_size : 0x048792c6 (75993798) + info : NULL + _pad : 0x06000000 (100663296) +push returned Success +pull returned Success + PAC_BUFFER: struct PAC_BUFFER + type : UNKNOWN_ENUM_VALUE (1094251328) + _ndr_size : 0x00000000 (0) + info : NULL + _pad : 0x00000000 (0) +WARNING! orig bytes:29 validated pushed bytes:16 +WARNING! orig and validated differ at byte 0x04 (4) +WARNING! orig byte[0x04] = 0xC6 validated byte[0x04] = 0x00 +dump OK +''' + try: + actual = self.check_output( + "ndrdump krb5pac PAC_BUFFER struct --validate --input " +\ + "QPM4QcaShwQAAAAAAAAABvX/ADw8Jf9wFh+gEoQ= --base64-input") + except BlackboxProcessError as e: + self.fail(e) + + self.assertEqual(actual, expected) diff --git a/selftest/knownfail.d/ndrdump-NULL-union b/selftest/knownfail.d/ndrdump-NULL-union new file mode 100644 index 00000000000..64e7e932fd2 --- /dev/null +++ b/selftest/knownfail.d/ndrdump-NULL-union @@ -0,0 +1 @@ +^samba.tests.blackbox.ndrdump.samba.tests.blackbox.ndrdump.NdrDumpTests.test_ndrdump_fuzzed_NULL_union_PAC_BUFFER