diff options
author | Andrew Bartlett <abartlet@samba.org> | 2019-02-04 11:22:34 +1300 |
---|---|---|
committer | Stefan Metzmacher <metze@samba.org> | 2019-02-26 12:15:12 +0100 |
commit | a3c42ff9331642ea989cba20175b7813050b9f5f (patch) | |
tree | 6d3efee948c49fd428defa4b1c070b454afb6b63 | |
parent | e8af7222d2de69d19216b922d5a85e4259ea5c40 (diff) | |
download | samba-a3c42ff9331642ea989cba20175b7813050b9f5f.tar.gz |
CVE-2019-3824 ldb: Extra comments to clarify no pointer wrap in wildcard processing
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13773
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
-rw-r--r-- | lib/ldb/common/ldb_match.c | 25 |
1 files changed, 23 insertions, 2 deletions
diff --git a/lib/ldb/common/ldb_match.c b/lib/ldb/common/ldb_match.c index 09e57e97fc6..9af558c7b89 100644 --- a/lib/ldb/common/ldb_match.c +++ b/lib/ldb/common/ldb_match.c @@ -306,12 +306,33 @@ static int ldb_wildcard_compare(struct ldb_context *ldb, p = memmem((const void *)val.data,val.length, (const void *)cnk.data, cnk.length); if (p == NULL) goto mismatch; + + /* + * At this point we know cnk.length <= val.length as + * otherwise there could be no match + */ + if ( (! tree->u.substring.chunks[c + 1]) && (! tree->u.substring.end_with_wildcard) ) { uint8_t *g; uint8_t *end = val.data + val.length; do { /* greedy */ - g = memmem(p + cnk.length, - end - (p + cnk.length), + + /* + * haystack is a valid pointer in val + * because the memmem() can only + * succeed if the needle (cnk.length) + * is <= haystacklen + * + * p will be a pointer at least + * cnk.length from the end of haystack + */ + uint8_t *haystack + = p + cnk.length; + size_t haystacklen + = end - (haystack); + + g = memmem(haystack, + haystacklen, (const uint8_t *)cnk.data, cnk.length); if (g) p = g; |