librpc ndr: NDR_PULL_ALIGN check for unsigned overflow

Handle uint32 overflow in NDR_PULL_ALIGN

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20083
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14236

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/librpc/ndr/libndr.h b/librpc/ndr/libndr.h
index b7cccf3dfc5c33924d7283504cbb8d6f779752b4..c2c7e2630496dfe1ddd9acb1f0b6f71ae508f1ae 100644 (file)
--- a/librpc/ndr/libndr.h
+++ b/librpc/ndr/libndr.h
@@ -331,6 +331,13 @@ enum ndr_compression_alg {
                if (unlikely(ndr->flags & LIBNDR_FLAG_PAD_CHECK)) {     \
                        ndr_check_padding(ndr, n); \
                } \
+               if(unlikely( \
+                       ((ndr->offset + (n-1)) & (~(n-1))) < ndr->offset)) {\
+                       return ndr_pull_error( \
+                               ndr, \
+                               NDR_ERR_BUFSIZE, \
+                               "Pull align (overflow) %u", (unsigned)n); \
+               } \
                ndr->offset = (ndr->offset + (n-1)) & ~(n-1); \
        } \
        if (unlikely(ndr->offset > ndr->data_size)) {                   \

diff --git a/selftest/knownfail.d/bug-14236 b/selftest/knownfail.d/bug-14236
index 343a7ec6f15c05f4426c88576d657183bafd6f5c..64b956997a6f467726a1a03f64c6f3850668b81e 100644 (file)
--- a/selftest/knownfail.d/bug-14236
+++ b/selftest/knownfail.d/bug-14236
@@ -1,2 +1 @@
 ^samba.tests.blackbox.ndrdump.samba.tests.blackbox.ndrdump.NdrDumpTests.test_ndrdump_fuzzed_ndr_compression
-^librpc.ndr.ndr.test_NDR_PULL_ALIGN