CVE-2026-58224: ctdb-protocol: Avoid off-by-one error for bytes pulled

As per the comment, if there is no NUL byte in the buffer then don't
count one in the number of bytes pulled.

Note that this is unlikely to be a security issue because it would
take a protocol bug elsewhere to overrun the buffer.  However, include
this fix here for posterity.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085

Reported-by: Andrew Tridgell (issue 16)
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

diff --git a/ctdb/protocol/protocol_basic.c b/ctdb/protocol/protocol_basic.c
index 42f207790d024370b7f2c379f02fa40b8a25da81..9cc52def6447175f3a9517e20af64a26b4e8462e 100644 (file)
--- a/ctdb/protocol/protocol_basic.c
+++ b/ctdb/protocol/protocol_basic.c
@@ -247,7 +247,8 @@ void ctdb_string_push(const char **in, uint8_t *buf, size_t *npush)
 int ctdb_string_pull(uint8_t *buf, size_t buflen, TALLOC_CTX *mem_ctx,
                     const char **out, size_t *npull)
 {
-       const char *str;
+       const char *str = NULL;
+       size_t len = 0;
 
        if (buflen > UINT32_MAX) {
                return EMSGSIZE;
@@ -265,7 +266,14 @@ int ctdb_string_pull(uint8_t *buf, size_t buflen, TALLOC_CTX *mem_ctx,
        }
 
        *out = str;
-       *npull = ctdb_string_len(&str);
+       /*
+        * Avoid claiming to have consumed more than buflen.
+        * ctdb_string_len() returns buflen + 1 if there is no
+        * NUL-terminator within buflen, so no NUL was actually
+        * consumed (so no +1 needed).
+        */
+       len = ctdb_string_len(&str);
+       *npull = MIN(buflen, len);
        return 0;
 }