From: Andrew Bartlett Date: Tue, 19 Nov 2019 04:38:50 +0000 (+1300) Subject: librpc: Check for NULL pointer in value() in ntlmssp_AUTHENTICATE X-Git-Tag: ldb-2.1.0~653 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f7f92803f600f8d302cdbb668c42ca8b186a797f;p=thirdparty%2Fsamba.git librpc: Check for NULL pointer in value() in ntlmssp_AUTHENTICATE This allows ndrdump --validate to avoid following a NULL pointer when re-pushing a valid but unusual input. It also avoids an issue if the Samba server code were to provide a response without an EncryptedRandomSessionKey. At this stage ntlmssp.idl is not used for this, instead the packets are generated with msrpc_gen(). Found by Douglas Bagnall using Hongfuzz and the new fuzz_ndr_X fuzzer. Signed-off-by: Andrew Bartlett Reviewed-by: Douglas Bagnall Autobuild-User(master): Andrew Bartlett Autobuild-Date(master): Wed Nov 20 06:06:29 UTC 2019 on sn-devel-184 --- diff --git a/librpc/idl/ntlmssp.idl b/librpc/idl/ntlmssp.idl index f984b7b0b4c..dd4c0b91640 100644 --- a/librpc/idl/ntlmssp.idl +++ b/librpc/idl/ntlmssp.idl @@ -271,7 +271,7 @@ interface ntlmssp [value(ndr_ntlmssp_string_length(NegotiateFlags, Workstation))] uint16 WorkstationLen; [value(WorkstationLen)] uint16 WorkstationMaxLen; [relative] [subcontext(0),subcontext_size(WorkstationLen)] [flag(ndr_ntlmssp_negotiated_string_flags(r->NegotiateFlags))] string *Workstation; - [value(EncryptedRandomSessionKey->length)] uint16 EncryptedRandomSessionKeyLen; + [value(EncryptedRandomSessionKey == NULL ? 0 : EncryptedRandomSessionKey->length)] uint16 EncryptedRandomSessionKeyLen; [value(EncryptedRandomSessionKeyLen)] uint16 EncryptedRandomSessionKeyMaxLen; [relative] [subcontext(0),subcontext_size(EncryptedRandomSessionKeyLen)] DATA_BLOB *EncryptedRandomSessionKey; NEGOTIATE NegotiateFlags; diff --git a/selftest/knownfail.d/ndrdump-NTLMSSP b/selftest/knownfail.d/ndrdump-NTLMSSP deleted file mode 100644 index 40ff0538cda..00000000000 --- a/selftest/knownfail.d/ndrdump-NTLMSSP +++ /dev/null @@ -1 +0,0 @@ -samba.tests.blackbox.ndrdump.samba.tests.blackbox.ndrdump.NdrDumpTests.test_ndrdump_fuzzed_ntlmsssp_AUTHENTICATE_MESSAGE \ No newline at end of file