From: Martin Schwenke Date: Sat, 30 May 2026 04:38:02 +0000 (+1000) Subject: CVE-2026-58224: ctdb-protocol: Avoid DoS memory allocation X-Git-Tag: talloc-2.5.0~24 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6115bcd51ff8a56c2c44b57edd472fcf12c3eff7;p=thirdparty%2Fsamba.git CVE-2026-58224: ctdb-protocol: Avoid DoS memory allocation The pull loop already avoids out of bounds accesses beyond the end of the buffer. However, it does not avoid a DoS memory allocation due to an unreasonably large array size. Check that the number of specified array elements can be pulled from buffer, which puts a reasonable upper bound on the subsequent memory allocation. Use an initialised dummy variable to avoid static analysers complaining about uninitialised variables being passed. Variable i could be reused but that might be confusing, so leave any optimisation to the compiler. BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085 Reported-by: Martin Schwenke Reported-by: Also Andrew Tridgell (issue 22) Signed-off-by: Martin Schwenke Reviewed-by: Tristan Madani Reviewed-by: Stefan Metzmacher --- diff --git a/ctdb/protocol/protocol_types.c b/ctdb/protocol/protocol_types.c index 146e2ea41c7..a61b54fb4bd 100644 --- a/ctdb/protocol/protocol_types.c +++ b/ctdb/protocol/protocol_types.c @@ -925,6 +925,7 @@ int ctdb_vnn_map_pull(uint8_t *buf, size_t buflen, TALLOC_CTX *mem_ctx, struct ctdb_vnn_map *val; size_t offset = 0, np; uint32_t i; + uint32_t dummy = 0; int ret; val = talloc(mem_ctx, struct ctdb_vnn_map); @@ -950,6 +951,11 @@ int ctdb_vnn_map_pull(uint8_t *buf, size_t buflen, TALLOC_CTX *mem_ctx, goto done; } + if ((uint64_t)val->size * ctdb_uint32_len(&dummy) > buflen - offset) { + ret = EMSGSIZE; + goto fail; + } + val->map = talloc_array(val, uint32_t, val->size); if (val->map == NULL) { ret = ENOMEM;