diff options
| author | Gary Lockyer <gary@catalyst.net.nz> | 2020-06-24 14:27:08 +1200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2020-06-25 13:04:45 +0200 |
| commit | 2e190d5c766d3487223ccdd4dc1e2ad0e160bb3f (patch) | |
| tree | 508fa9f207f9f3e4a2569ab2a2420ca1472657c0 | |
| parent | 9773231e3a53291214a914ed168065f5ed5ea1e6 (diff) | |
| download | samba-2e190d5c766d3487223ccdd4dc1e2ad0e160bb3f.tar.gz | |
CVE-2020-14303: s4 nbt: fix busy loop on empty UDP packet
An empty UDP packet put the nbt server into a busy loop that consumes
100% of a cpu.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14417
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
| -rw-r--r-- | libcli/nbt/nbtsocket.c | 17 | ||||
| -rw-r--r-- | selftest/knownfail.d/empty-nbt | 1 |
2 files changed, 16 insertions, 2 deletions
diff --git a/libcli/nbt/nbtsocket.c b/libcli/nbt/nbtsocket.c index 33d53fba993..8aecaf73247 100644 --- a/libcli/nbt/nbtsocket.c +++ b/libcli/nbt/nbtsocket.c @@ -167,8 +167,23 @@ static void nbt_name_socket_recv(struct nbt_name_socket *nbtsock) return; } + /* + * Given a zero length, data_blob_talloc() returns the + * NULL blob {NULL, 0}. + * + * We only want to error return here on a real out of memory condition + * (i.e. dsize != 0, so the UDP packet has data, but the return of the + * allocation failed, so blob.data==NULL). + * + * Given an actual zero length UDP packet having blob.data == NULL + * isn't an out of memory error condition, that's the defined semantics + * of data_blob_talloc() when asked for zero bytes. + * + * We still need to continue to do the zero-length socket_recvfrom() + * read in order to clear the "read pending" condition on the socket. + */ blob = data_blob_talloc(tmp_ctx, NULL, dsize); - if (blob.data == NULL) { + if (blob.data == NULL && dsize != 0) { talloc_free(tmp_ctx); return; } diff --git a/selftest/knownfail.d/empty-nbt b/selftest/knownfail.d/empty-nbt deleted file mode 100644 index e4bcccab4e5..00000000000 --- a/selftest/knownfail.d/empty-nbt +++ /dev/null @@ -1 +0,0 @@ -^samba.tests.dns_packet.samba.tests.dns_packet.TestNbtPackets.test_empty_packet
\ No newline at end of file |