diff options
| author | Gary Lockyer <gary@catalyst.net.nz> | 2019-12-09 09:19:47 +1300 |
|---|---|---|
| committer | Andrew Bartlett <abartlet@samba.org> | 2019-12-12 00:35:30 +0000 |
| commit | ee4617ec5f4017e7ee3bbc29102054e7b64f3e3a (patch) | |
| tree | b16c79141a36f2d3197f3d0d95ac56973181d275 /selftest/knownfail.d | |
| parent | 049f0c3870179aa4977f5d9c49e18566f166412e (diff) | |
| download | samba-ee4617ec5f4017e7ee3bbc29102054e7b64f3e3a.tar.gz | |
librpc dnsp test: Ensure length matches union selector
Ensure that a dnsp_DnsProperty is rejected if the length data does not not
correspond to the length indicated by the union id. It was possible for
the union to be referencing memory past the end of the structure.
Found by Douglas Bagnall using Hongfuzz and the new fuzz_ndr_X fuzzer.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14206
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Diffstat (limited to 'selftest/knownfail.d')
| -rw-r--r-- | selftest/knownfail.d/bug-14206 | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/selftest/knownfail.d/bug-14206 b/selftest/knownfail.d/bug-14206 new file mode 100644 index 00000000000..e2d9439179d --- /dev/null +++ b/selftest/knownfail.d/bug-14206 @@ -0,0 +1,2 @@ +^samba4.local.ndr.dnsp_DnsProperty\(none\) +^samba4.local.ndr.system.iconv.dnsp_DnsProperty\(none\) |