diff options
| author | Douglas Bagnall <douglas.bagnall@catalyst.net.nz> | 2020-04-25 11:10:18 +1200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2020-06-25 13:04:45 +0200 |
| commit | dbde3431f70ec0cf9c0da7abe7bc53fd4e5d3a63 (patch) | |
| tree | 828b0c9364eb17801fe2c00f98f8766049a78ca5 /librpc/ndr | |
| parent | 0c6bbd701926dfc16754fc5ea523d6f21d0ea740 (diff) | |
| download | samba-dbde3431f70ec0cf9c0da7abe7bc53fd4e5d3a63.tar.gz | |
CVE-2020-10745: ndr_dns: do not allow consecutive dots
The empty subdomain component is reserved for the root domain, which we
should only (and always) see at the end of the list. That is, we expect
"example.com.", but never "example..com".
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14378
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Diffstat (limited to 'librpc/ndr')
| -rw-r--r-- | librpc/ndr/ndr_dns_utils.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/librpc/ndr/ndr_dns_utils.c b/librpc/ndr/ndr_dns_utils.c index 2ce300863bc..6931dac422d 100644 --- a/librpc/ndr/ndr_dns_utils.c +++ b/librpc/ndr/ndr_dns_utils.c @@ -58,6 +58,12 @@ enum ndr_err_code ndr_push_dns_string_list(struct ndr_push *ndr, (unsigned)complen); } + if (complen == 0 && s[complen] == '.') { + return ndr_push_error(ndr, NDR_ERR_STRING, + "component length is 0 " + "(consecutive dots)"); + } + compname = talloc_asprintf(ndr, "%c%*.*s", (unsigned char)complen, (unsigned char)complen, |