diff options
| author | Volker Lendecke <vl@samba.org> | 2018-10-02 13:16:04 +0200 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2018-10-08 22:17:09 +0200 |
| commit | 2a35cbb02f09e490f2b533849a08100881f12230 (patch) | |
| tree | 6e68e58bace358dc97e865233c626a9947c944e7 /source3/registry | |
| parent | 1fb2d10d381cf0dd8e66fc4867e936ef37011e64 (diff) | |
| download | samba-2a35cbb02f09e490f2b533849a08100881f12230.tar.gz | |
registry: Add error checks to regdb_fetch_keys_internal
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Diffstat (limited to 'source3/registry')
| -rw-r--r-- | source3/registry/reg_backend_db.c | 18 |
1 files changed, 17 insertions, 1 deletions
diff --git a/source3/registry/reg_backend_db.c b/source3/registry/reg_backend_db.c index aa97d60abec..a0db5eab9ce 100644 --- a/source3/registry/reg_backend_db.c +++ b/source3/registry/reg_backend_db.c @@ -1784,7 +1784,23 @@ static WERROR regdb_fetch_keys_internal(struct db_context *db, const char *key, } for (i=0; i<num_items; i++) { - len += tdb_unpack(buf+len, buflen-len, "f", subkeyname); + int this_len; + + this_len = tdb_unpack(buf+len, buflen-len, "f", subkeyname); + if (this_len == -1) { + DBG_WARNING("Invalid registry data, " + "tdb_unpack failed\n"); + werr = WERR_INTERNAL_DB_CORRUPTION; + goto done; + } + len += this_len; + if (len < this_len) { + DBG_WARNING("Invalid registry data, " + "integer overflow\n"); + werr = WERR_INTERNAL_DB_CORRUPTION; + goto done; + } + werr = regsubkey_ctr_addkey(ctr, subkeyname); if (!W_ERROR_IS_OK(werr)) { DEBUG(5, ("regdb_fetch_keys: regsubkey_ctr_addkey " |