rpc: avoid undefined behaviour when parsing bindings
authorDouglas Bagnall <douglas.bagnall@catalyst.net.nz>
Mon, 19 Oct 2020 20:42:56 +0000 (09:42 +1300)
committerAndrew Bartlett <abartlet@samba.org>
Fri, 23 Oct 2020 03:25:35 +0000 (03:25 +0000)
commit302098c3259c3709f61e5f2859785dbb62a393e5
tree0b011c00f6850fb001f823845d096d5f9c25ee1a
parent09479bf0ee12b8187736b0d6f4dcf0303569169a
rpc: avoid undefined behaviour when parsing bindings

If the binding string ends with "[", we were setting options to an
empty string, then asking for 'options[strlen(options)-1]', which
UBSan dosn't like because the offset evaluates to (size_t)0xFFFFF...
causing pointer overflow.

I believe this is actually well defined in practice, but we don't want
to be in the habit of leaving sanitiser warnings in code parsing
untrusted strings.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
librpc/rpc/binding.c