diff options
| author | Douglas Bagnall <douglas.bagnall@catalyst.net.nz> | 2020-12-08 21:32:09 +1300 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2021-03-19 08:51:01 +0100 |
| commit | fab6b79b7724f0b636963be528483e3e946884aa (patch) | |
| tree | 2589d517c53603c59b87a251ceafee43aaa17242 | |
| parent | 50e44877c3df8098658bd4b1fdad25b8aaadf6f3 (diff) | |
| download | samba-fab6b79b7724f0b636963be528483e3e946884aa.tar.gz | |
CVE-2021-20277 ldb/attrib_handlers casefold: stay in bounds
For a string that had N spaces at the beginning, we would
try to move N bytes beyond the end of the string.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14655
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry-picked from commit for master)
| -rw-r--r-- | lib/ldb/common/attrib_handlers.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/ldb/common/attrib_handlers.c b/lib/ldb/common/attrib_handlers.c index b5212b73159..c6ef5ad477b 100644 --- a/lib/ldb/common/attrib_handlers.c +++ b/lib/ldb/common/attrib_handlers.c @@ -76,7 +76,7 @@ int ldb_handler_fold(struct ldb_context *ldb, void *mem_ctx, /* remove leading spaces if any */ if (*s == ' ') { - for (t = s; *s == ' '; s++) ; + for (t = s; *s == ' '; s++, l--) ; /* remove leading spaces by moving down the string */ memmove(t, s, l); |