librpc: Do not access name[-1] trying to push "" into a dnsp_name
authorAndrew Bartlett <abartlet@samba.org>
Thu, 19 Dec 2019 21:50:09 +0000 (10:50 +1300)
committerRalph Boehme <slow@samba.org>
Fri, 20 Dec 2019 11:33:52 +0000 (11:33 +0000)
commita85d257c1ec3a4505f2a4fcbec0f7e1f60dbff91
tree4940c4ea2ef423028f585a6cbb26d570f02097d8
parent16557e4480a7502d45186854546d502479be156f
librpc: Do not access name[-1] trying to push "" into a dnsp_name

This simply matches the behaviour from before e7b1acaddf2ccc7de0301cc67f72187ab450e7b5
when the logic for a trailing . was added.  This matches what is added in
the dnsRecord attribute for a name of "." over the dnsserver RPC
management interface and is based on what Windows does for that name
in (eg) an MX record.

No a security bug because we use talloc and so name will be just the
end of the talloc header.

Credit to OSS-Fuzz

Found using the fuzz_ndr_X fuzzer

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Fri Dec 20 11:33:52 UTC 2019 on sn-devel-184
librpc/ndr/ndr_dnsp.c
selftest/knownfail.d/ndrdump-dnsp_name [deleted file]