regfio: Improve handling of malformed registry hive files
authorMichael Hanselmann <public@hansmi.ch>
Sun, 17 Mar 2019 12:49:20 +0000 (13:49 +0100)
committerAndrew Bartlett <abartlet@samba.org>
Wed, 20 Mar 2019 05:26:18 +0000 (05:26 +0000)
commit601afd690346087fbd53819dba9b1afa81560064
tree1d1396642cd1df0b0bd14dd3e55af2c8d31d31ae
parent9b2cb845b23cd1c91ab3b5ea8ad791b18b3ab733
regfio: Improve handling of malformed registry hive files

* next_record: A malformed file can lead to an endless loop.
* regfio_rootkey: Supplying a malformed registry hive file to the
  registry hive I/O code can lead to out-of-bounds reads.

Test cases are included. Both issues resolved have been identified using
AddressSanitizer.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13840

Signed-off-by: Michael Hanselmann <public@hansmi.ch>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
source3/registry/regfio.c
source3/registry/tests/test_regfio.c
testdata/samba3/regfio_corrupt_hbin1.dat [new file with mode: 0644]
testdata/samba3/regfio_corrupt_lf_subkeys.dat [new file with mode: 0644]