s4:torture: witness packet of zero size empty blobs should fail

REF: https://issues.oss-fuzz.com/issues/482968113

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>

diff --git a/selftest/knownfail.d/witness b/selftest/knownfail.d/witness
new file mode 100644 (file)
index 0000000..2dfe89a
--- /dev/null
+++ b/selftest/knownfail.d/witness
@@ -0,0 +1,2 @@
+^samba4\.local\.ndr\.witness\.witness_notifyResponse\.witness_notifyResponse_data_fuzz2_STRUCT\(none\)
+^samba4\.local\.ndr\.system\.iconv\.witness\.witness_notifyResponse\.witness_notifyResponse_data_fuzz2_STRUCT\(none\)

diff --git a/source4/torture/ndr/witness.c b/source4/torture/ndr/witness.c
index 496d04570a91efaf2723648cc7161f33ca6d2988..c07f19777abd86a4d75095a1c35cf1a481f184c7 100644 (file)
--- a/source4/torture/ndr/witness.c
+++ b/source4/torture/ndr/witness.c
@@ -334,6 +334,13 @@ static bool witness_AsyncNotify_check_fuzz1_OUT(struct torture_context *tctx,
        return true;
 }
 
+
+static const uint8_t witness_notifyResponse_data_fuzz2_STRUCT[] = {
+       0x20, 0x2c, 0x71, 0x00, 0x04, 0x00, 0x00, 0x00, 0x01, 0x00, 0xa1, 0x00,
+       0x31, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+};
+
+
 struct torture_suite *ndr_witness_suite(TALLOC_CTX *ctx)
 {
        struct torture_suite *suite = torture_suite_create(ctx, "witness");
@@ -407,5 +414,10 @@ struct torture_suite *ndr_witness_suite(TALLOC_CTX *ctx)
                                            0,
                                            witness_AsyncNotify_check_fuzz1_OUT);
 
+       torture_suite_add_ndr_pull_invalid_data_test(suite,
+                                                    witness_notifyResponse,
+                                                    witness_notifyResponse_data_fuzz2_STRUCT,
+                                                    NDR_ERR_BAD_SWITCH);
+
        return suite;
 }