diff options
| author | Jeremy Allison <jra@samba.org> | 2017-09-20 11:04:50 -0700 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2017-11-21 19:42:22 +0100 |
| commit | 33f88abe6b14cf86360efd98ab4b66520244c2a7 (patch) | |
| tree | 4850c636c54d74e9eb252363ef82ce175ef66af7 /source3/smbd | |
| parent | deda04389a7e0baddb88d4d611a6f07926776b28 (diff) | |
| download | samba-33f88abe6b14cf86360efd98ab4b66520244c2a7.tar.gz | |
s3: smbd: Chain code can return uninitialized memory when talloc buffer is grown.
Ensure we zero out unused grown area.
CVE-2017-15275
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13077
Signed-off-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Tue Nov 21 19:42:22 CET 2017 on sn-devel-144
Diffstat (limited to 'source3/smbd')
| -rw-r--r-- | source3/smbd/srvstr.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/source3/smbd/srvstr.c b/source3/smbd/srvstr.c index 56dceba8c6c..c2d70b32c32 100644 --- a/source3/smbd/srvstr.c +++ b/source3/smbd/srvstr.c @@ -110,6 +110,20 @@ ssize_t message_push_string(uint8_t **outbuf, const char *str, int flags) DEBUG(0, ("srvstr_push failed\n")); return -1; } + + /* + * Ensure we clear out the extra data we have + * grown the buffer by, but not written to. + */ + if (buf_size + result < buf_size) { + return -1; + } + if (grow_size < result) { + return -1; + } + + memset(tmp + buf_size + result, '\0', grow_size - result); + set_message_bcc((char *)tmp, smb_buflen(tmp) + result); *outbuf = tmp; |