diff options
| author | Douglas Bagnall <douglas.bagnall@catalyst.net.nz> | 2020-12-08 21:32:09 +1300 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2021-03-22 11:53:16 +0100 |
| commit | 719c8484bf59653bb25acf2b85dccd0a853f31c6 (patch) | |
| tree | ce163854eea9a167e515085de495d7e2acdab348 | |
| parent | 93d0e1cbc2753a3556ec35ffaca5c1f3c6a92324 (diff) | |
| download | samba-719c8484bf59653bb25acf2b85dccd0a853f31c6.tar.gz | |
CVE-2021-20277 ldb/attrib_handlers casefold: stay in bounds
For a string that had N spaces at the beginning, we would
try to move N bytes beyond the end of the string.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14655
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry-picked from commit for master)
| -rw-r--r-- | lib/ldb/common/attrib_handlers.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/ldb/common/attrib_handlers.c b/lib/ldb/common/attrib_handlers.c index b5212b73159..c6ef5ad477b 100644 --- a/lib/ldb/common/attrib_handlers.c +++ b/lib/ldb/common/attrib_handlers.c @@ -76,7 +76,7 @@ int ldb_handler_fold(struct ldb_context *ldb, void *mem_ctx, /* remove leading spaces if any */ if (*s == ' ') { - for (t = s; *s == ' '; s++) ; + for (t = s; *s == ' '; s++, l--) ; /* remove leading spaces by moving down the string */ memmove(t, s, l); |