From ad236bb7590e423b4c69fe6028f2f3495977f48b Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Fri, 17 Jan 2020 13:49:48 -0800 Subject: s3: lib: nmblib. Clean up and harden nmb packet processing. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14239 OSS-FUZZ: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20156 OSS-FUZZ: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20157 Credit to oss-fuzz. No security implications. Signed-off-by: Jeremy Allison Pair programmed with: Douglas Bagnall Reviewed-by: Douglas Bagnall Autobuild-User(master): Jeremy Allison Autobuild-Date(master): Tue Jan 21 23:33:41 UTC 2020 on sn-devel-184 --- source3/libsmb/nmblib.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/source3/libsmb/nmblib.c b/source3/libsmb/nmblib.c index b6dca800e94..84cbb054b8e 100644 --- a/source3/libsmb/nmblib.c +++ b/source3/libsmb/nmblib.c @@ -192,10 +192,14 @@ static int parse_nmb_name(char *inbuf,int ofs,int length, struct nmb_name *name) m = ubuf[offset]; - if (!m) - return(0); - if ((m & 0xC0) || offset+m+2 > length) - return(0); + /* m must be 32 to exactly fill in the 16 bytes of the netbios name */ + if (m != 32) { + return 0; + } + /* Cannot go past length. */ + if (offset+m+2 > length) { + return 0; + } memset((char *)name,'\0',sizeof(*name)); -- cgit v1.2.1