librpc: Do not follow a NULL pointer when calculating the size of a union

Found by Douglas Bagnall using Hongfuzz and the new fuzz_ndr_X
fuzzer.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>

diff --git a/librpc/ndr/ndr.c b/librpc/ndr/ndr.c
index dc83cf35ffd96cd8f5d5c45554d6a30ce434d927..4c628c1dae40b89ac62b269b8eee34ed6572623f 100644 (file)
--- a/librpc/ndr/ndr.c
+++ b/librpc/ndr/ndr.c
@@ -1522,6 +1522,11 @@ _PUBLIC_ size_t ndr_size_union(const void *p, int flags, uint32_t level, ndr_pus
        /* avoid recursion */
        if (flags & LIBNDR_FLAG_NO_NDR_SIZE) return 0;
 
+       /* Avoid following a NULL pointer */
+       if (p == NULL) {
+               return 0;
+       }
+
        ndr = ndr_push_init_ctx(NULL);
        if (!ndr) return 0;
        ndr->flags |= flags | LIBNDR_FLAG_NO_NDR_SIZE;

diff --git a/selftest/knownfail.d/ndrdump-NULL-union b/selftest/knownfail.d/ndrdump-NULL-union
deleted file mode 100644 (file)
index 64e7e93..0000000
--- a/selftest/knownfail.d/ndrdump-NULL-union
+++ /dev/null
@@ -1 +0,0 @@
-^samba.tests.blackbox.ndrdump.samba.tests.blackbox.ndrdump.NdrDumpTests.test_ndrdump_fuzzed_NULL_union_PAC_BUFFER