Fixes to check for wraps which could cause coredumps.

Jeremy.
(This used to be commit 124a8ddae63adff4f601242a8e6d05abcaf4d9bf)

diff --git a/source3/lib/smbldap.c b/source3/lib/smbldap.c
index 8f58e80ddef59d8179850001056af54aeeafad68..fe34cfb852e136767e79e0203df0e191160b0a6e 100644 (file)
--- a/source3/lib/smbldap.c
+++ b/source3/lib/smbldap.c
@@ -258,6 +258,7 @@ BOOL fetch_ldap_pw(char **dn, char** pw)
                        return False;
                }
 
+               size = MIN(size, sizeof(fstring)-1);
                strncpy(old_style_pw, data, size);
                old_style_pw[size] = 0;
 

diff --git a/source3/libsmb/clilist.c b/source3/libsmb/clilist.c
index 7822987ada80e21ebfb98c137fd248f3dd5f806d..2c1831ae990a35e5efa7c82162f350015a7a9eeb 100644 (file)
--- a/source3/libsmb/clilist.c
+++ b/source3/libsmb/clilist.c
@@ -82,7 +82,7 @@ static int interpret_long_filename(struct cli_state *cli,
                        
                case 260: /* NT uses this, but also accepts 2 */
                {
-                       int namelen, slen;
+                       size_t namelen, slen;
                        p += 4; /* next entry offset */
                        p += 4; /* fileindex */
                                

diff --git a/source3/libsmb/ntlmssp_parse.c b/source3/libsmb/ntlmssp_parse.c
index 60cb4ab04aec20849eab2e372125ec5ea94c4afc..b136dacf5a2549792b30498ab8dbd58437be5740 100644 (file)
--- a/source3/libsmb/ntlmssp_parse.c
+++ b/source3/libsmb/ntlmssp_parse.c
@@ -226,7 +226,7 @@ BOOL msrpc_parse(const DATA_BLOB *blob,
                                *ps = smb_xstrdup("");
                        } else {
                                /* make sure its in the right format - be strict */
-                               if (len1 != len2 || ptr + len1 > blob->length) {
+                               if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) {
                                        return False;
                                }
                                if (len1 & 1) {
@@ -255,7 +255,7 @@ BOOL msrpc_parse(const DATA_BLOB *blob,
                        if (len1 == 0 && len2 == 0) {
                                *ps = smb_xstrdup("");
                        } else {
-                               if (len1 != len2 || ptr + len1 > blob->length) {
+                               if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) {
                                        return False;
                                }
                                
@@ -280,7 +280,7 @@ BOOL msrpc_parse(const DATA_BLOB *blob,
                                *b = data_blob(NULL, 0);
                        } else {
                                /* make sure its in the right format - be strict */
-                               if (len1 != len2 || ptr + len1 > blob->length) {
+                               if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) {
                                        return False;
                                }
                                *b = data_blob(blob->data + ptr, len1);
@@ -314,4 +314,3 @@ BOOL msrpc_parse(const DATA_BLOB *blob,
 
        return True;
 }
-

diff --git a/source3/nmbd/nmbd_processlogon.c b/source3/nmbd/nmbd_processlogon.c
index 2a6a6b66d1f511499d117dbd6cfdb190c713b455..816b3514644a73ea3dd7b78326a4486b6eb88b13 100644 (file)
--- a/source3/nmbd/nmbd_processlogon.c
+++ b/source3/nmbd/nmbd_processlogon.c
@@ -491,6 +491,8 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n",
 
                                /* Domain SID */
 
+#if 0
+                               /* We must range check this. */
                                q += IVAL(q, 0) + 4;  /* 4 byte length plus data */
           
                                q += 2;               /* Alignment? */
@@ -500,6 +502,7 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n",
                                q += 4;               /* NT version (0x1) */
                                q += 2;               /* LMNT token (0xff) */
                                q += 2;               /* LM20 token (0xff) */
+#endif
 
                                SAFE_FREE(db_info);        /* Not sure whether we need to do anything useful with these */
 

diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c
index 5b5b5885ab0bd9afac020cb3eab84767efcea560..908bd9c887fd13f275934c2c2fef5d491fd1dfbd 100644 (file)
--- a/source3/printing/nt_printing.c
+++ b/source3/printing/nt_printing.c
@@ -728,7 +728,7 @@ const char *get_short_archi(const char *long_archi)
 static int get_file_version(files_struct *fsp, char *fname,uint32 *major, uint32 *minor)
 {
        int     i;
-       char    *buf;
+       char    *buf = NULL;
        ssize_t byte_count;
 
        if ((buf=malloc(PE_HEADER_SIZE)) == NULL) {
@@ -768,8 +768,8 @@ static int get_file_version(files_struct *fsp, char *fname,uint32 *major, uint32
 
        /* The header may be a PE (Portable Executable) or an NE (New Executable) */
        if (IVAL(buf,PE_HEADER_SIGNATURE_OFFSET) == PE_HEADER_SIGNATURE) {
-               int num_sections;
-               int section_table_bytes;
+               unsigned int num_sections;
+               unsigned int section_table_bytes;
                
                if (SVAL(buf,PE_HEADER_MACHINE_OFFSET) != PE_HEADER_MACHINE_I386) {
                        DEBUG(3,("get_file_version: PE file [%s] wrong machine = 0x%x\n",
@@ -783,6 +783,9 @@ static int get_file_version(files_struct *fsp, char *fname,uint32 *major, uint32
                /* get the section table */
                num_sections        = SVAL(buf,PE_HEADER_NUMBER_OF_SECTIONS);
                section_table_bytes = num_sections * PE_HEADER_SECT_HEADER_SIZE;
+               if (section_table_bytes == 0)
+                       goto error_exit;
+
                SAFE_FREE(buf);
                if ((buf=malloc(section_table_bytes)) == NULL) {
                        DEBUG(0,("get_file_version: PE file [%s] section table malloc failed bytes = %d\n",
@@ -801,8 +804,11 @@ static int get_file_version(files_struct *fsp, char *fname,uint32 *major, uint32
                        int sec_offset = i * PE_HEADER_SECT_HEADER_SIZE;
 
                        if (strcmp(".rsrc", &buf[sec_offset+PE_HEADER_SECT_NAME_OFFSET]) == 0) {
-                               int section_pos   = IVAL(buf,sec_offset+PE_HEADER_SECT_PTR_DATA_OFFSET);
-                               int section_bytes = IVAL(buf,sec_offset+PE_HEADER_SECT_SIZE_DATA_OFFSET);
+                               unsigned int section_pos   = IVAL(buf,sec_offset+PE_HEADER_SECT_PTR_DATA_OFFSET);
+                               unsigned int section_bytes = IVAL(buf,sec_offset+PE_HEADER_SECT_SIZE_DATA_OFFSET);
+
+                               if (section_bytes == 0)
+                                       goto error_exit;
 
                                SAFE_FREE(buf);
                                if ((buf=malloc(section_bytes)) == NULL) {
@@ -824,6 +830,9 @@ static int get_file_version(files_struct *fsp, char *fname,uint32 *major, uint32
                                        goto error_exit;
                                }
 
+                               if (section_bytes < VS_VERSION_INFO_UNICODE_SIZE)
+                                       goto error_exit;
+
                                for (i=0; i<section_bytes-VS_VERSION_INFO_UNICODE_SIZE; i++) {
                                        /* Scan for 1st 3 unicoded bytes followed by word aligned magic value */
                                        if (buf[i] == 'V' && buf[i+1] == '\0' && buf[i+2] == 'S') {

diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 011186ba89caf0b1309650a5da8fe858ae5ed404..3752507493073a520a6fd4aaeae5dc24c7a28bc9 100644 (file)
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -669,10 +669,9 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        time_t date;
        int dirtype;
        int outsize = 0;
-       int numentries = 0;
+       unsigned int numentries = 0;
+       unsigned int maxentries = 0;
        BOOL finished = False;
-       int maxentries;
-       int i;
        char *p;
        BOOL ok = False;
        int status_len;
@@ -786,6 +785,9 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                                        numentries = 0;
                                p += DIR_STRUCT_SIZE;
                        } else {
+                               unsigned int i;
+                               maxentries = MIN(maxentries, ((BUFFER_SIZE - (p - outbuf))/DIR_STRUCT_SIZE));
+
                                DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
                                conn->dirpath,lp_dontdescend(SNUM(conn))));
                                if (in_list(conn->dirpath, lp_dontdescend(SNUM(conn)),True))
@@ -845,7 +847,7 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        if ((! *directory) && dptr_path(dptr_num))
                slprintf(directory, sizeof(directory)-1, "(%s)",dptr_path(dptr_num));
 
-       DEBUG( 4, ( "%s mask=%s path=%s dtype=%d nument=%d of %d\n",
+       DEBUG( 4, ( "%s mask=%s path=%s dtype=%d nument=%u of %u\n",
                smb_fn_name(CVAL(inbuf,smb_com)), 
                mask, directory, dirtype, numentries, maxentries ) );