diff options
author | Volker Lendecke <vl@samba.org> | 2016-11-05 21:22:46 +0100 |
---|---|---|
committer | Karolin Seeger <kseeger@samba.org> | 2016-12-09 09:55:41 +0100 |
commit | c455677d43fbda512f0178a244c90591de481d51 (patch) | |
tree | 88d652de7e5a4a621f9f8301806a6a93667d4583 | |
parent | 609d1000444cc06c7bfcafb5d155ce4f3bfc07c5 (diff) | |
download | samba-c455677d43fbda512f0178a244c90591de481d51.tar.gz |
CVE-2016-2123: Fix DNS vuln ZDI-CAN-3995
Thanks to Trend Micro's Zero Day Initiative and Frederic Besler for finding
this vulnerability with a PoC and a good analysis.
Signed-off-by: Volker Lendecke <vl@samba.org>
Bug: https://bugzilla.samba.org/show_bug.cgi?id=12409
-rw-r--r-- | librpc/ndr/ndr_dnsp.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/librpc/ndr/ndr_dnsp.c b/librpc/ndr/ndr_dnsp.c index ff77bc7da6d..974ff5ebff2 100644 --- a/librpc/ndr/ndr_dnsp.c +++ b/librpc/ndr/ndr_dnsp.c @@ -56,7 +56,16 @@ _PUBLIC_ enum ndr_err_code ndr_pull_dnsp_name(struct ndr_pull *ndr, int ndr_flag uint8_t sublen, newlen; NDR_CHECK(ndr_pull_uint8(ndr, ndr_flags, &sublen)); newlen = total_len + sublen; + if (newlen < total_len) { + return ndr_pull_error(ndr, NDR_ERR_RANGE, + "Failed to pull dnsp_name"); + } if (i != count-1) { + if (newlen == UINT8_MAX) { + return ndr_pull_error( + ndr, NDR_ERR_RANGE, + "Failed to pull dnsp_name"); + } newlen++; /* for the '.' */ } ret = talloc_realloc(ndr->current_mem_ctx, ret, char, newlen); |