CVE-2026-4480/CVE-2026-4408: lib/util: let mask_unsafe_character() check all control...

There's no reason to mask only \r and \n.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16033
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

diff --git a/lib/util/substitute.c b/lib/util/substitute.c
index 465aea8660553aff2f2a2ea754562cd14e130a46..30989927da728709ba14960d2d089f689a319d86 100644 (file)
--- a/lib/util/substitute.c
+++ b/lib/util/substitute.c
@@ -22,6 +22,7 @@
 */
 
 #include "replace.h"
+#include "system/locale.h"
 #include "debug.h"
 #ifndef SAMBA_UTIL_CORE_ONLY
 #include "charset/charset.h"
@@ -53,6 +54,10 @@ char mask_unsafe_character(char in,
                return in;
        }
 
+       if (iscntrl(in)) {
+               return safe_out;
+       }
+
        unsafe = strchr(unsafe_characters, in);
        if (unsafe != NULL) {
                return safe_out;
@@ -69,7 +74,8 @@ char mask_unsafe_character(char in,
  This routine looks for pattern in s and replaces it with
  insert. It may do multiple replacements or just one.
 
- Any of STRING_SUB_UNSAFE_CHARACTERS in the insert string are replaced with _
+ Any of STRING_SUB_UNSAFE_CHARACTERS and any character
+ caught by calling iscntrl() in the insert string are replaced with _
 
  if len==0 then the string cannot be extended. This is different from the old
  use of len==0 which was for no length checks to be done.

diff --git a/lib/util/substitute.h b/lib/util/substitute.h
index 041a649fd1817dd5639af6a333aa4d40f8e61a6f..b183d864671a5d65c9ce7b30b91701e1c9fcde7b 100644 (file)
--- a/lib/util/substitute.h
+++ b/lib/util/substitute.h
@@ -26,7 +26,7 @@
 
 #include <talloc.h>
 
-#define STRING_SUB_UNSAFE_CHARACTERS "$`\"';%\r\n"
+#define STRING_SUB_UNSAFE_CHARACTERS "$`\"';%"
 
 /**
  Substitute a string for a pattern in another string. Make sure there is
@@ -35,8 +35,8 @@
  This routine looks for pattern in s and replaces it with
  insert. It may do multiple replacements.
 
- Any of STRING_SUB_UNSAFE_CHARACTERS (see above) in the
- insert string are replaced with _
+ Any of STRING_SUB_UNSAFE_CHARACTERS (see above) and any character
+ caught by calling iscntrl() in the insert string are replaced with _
 
  if len==0 then the string cannot be extended. This is different from the old
  use of len==0 which was for no length checks to be done.