fix the overflow/wrap checks in Samba4 for new gcc optimisation behavior

The approach I have used is as set out in
https://www.securecoding.cert.org/confluence/display/seccode/ARR38-C.+Do+not+add+or+subtract+an+integer+to+a+pointer+if+the+resulting+value+does+not+refer+to+an+element+within+the+array
(This used to be commit 92d5fb531db39be655f0cbd2d75b5f675a0a4cfa)

diff --git a/source4/libcli/raw/rawrequest.c b/source4/libcli/raw/rawrequest.c
index a42c71054718b1fb67268cbb31beda22498ba8e9..ef856c6ea1d0c5799d72d879694d2f3aa7dcc6e2 100644 (file)
--- a/source4/libcli/raw/rawrequest.c
+++ b/source4/libcli/raw/rawrequest.c
@@ -700,10 +700,10 @@ DATA_BLOB smbcli_req_pull_blob(struct request_bufinfo *bufinfo, TALLOC_CTX *mem_
 static bool smbcli_req_data_oob(struct request_bufinfo *bufinfo, const uint8_t *ptr, uint32_t count)
 {
        /* be careful with wraparound! */
-       if (ptr < bufinfo->data ||
-           ptr >= bufinfo->data + bufinfo->data_size ||
+       if ((uintptr_t)ptr < (uintptr_t)bufinfo->data ||
+           (uintptr_t)ptr >= (uintptr_t)bufinfo->data + bufinfo->data_size ||
            count > bufinfo->data_size ||
-           ptr + count > bufinfo->data + bufinfo->data_size) {
+           (uintptr_t)ptr + count > (uintptr_t)bufinfo->data + bufinfo->data_size) {
                return true;
        }
        return false;

diff --git a/source4/libcli/raw/rawtrans.c b/source4/libcli/raw/rawtrans.c
index 29881afd2bc2ff7be350842ef36304a50b63c9e9..0f15b2151b6046452b0a1519c3e780875b9d7386 100644 (file)
--- a/source4/libcli/raw/rawtrans.c
+++ b/source4/libcli/raw/rawtrans.c
@@ -40,10 +40,10 @@ static bool raw_trans_oob(struct smbcli_request *req,
        ptr = req->in.hdr + offset;
        
        /* be careful with wraparound! */
-       if (ptr < req->in.data ||
-           ptr >= req->in.data + req->in.data_size ||
+       if ((uintptr_t)ptr < (uintptr_t)req->in.data ||
+           (uintptr_t)ptr >= (uintptr_t)req->in.data + req->in.data_size ||
            count > req->in.data_size ||
-           ptr + count > req->in.data + req->in.data_size) {
+           (uintptr_t)ptr + count > (uintptr_t)req->in.data + req->in.data_size) {
                return true;
        }
        return false;   

diff --git a/source4/libcli/smb2/request.c b/source4/libcli/smb2/request.c
index 2471fcaa4ddae7342679e789153b101fb18c74e5..f52b0ceef2586ab17f22fbfcc639c51134078854 100644 (file)
--- a/source4/libcli/smb2/request.c
+++ b/source4/libcli/smb2/request.c
@@ -211,10 +211,10 @@ bool smb2_oob(struct smb2_request_buffer *buf, const uint8_t *ptr, size_t size)
                return false;
        }
        /* be careful with wraparound! */
-       if (ptr < buf->body ||
-           ptr >= buf->body + buf->body_size ||
+       if ((uintptr_t)ptr < (uintptr_t)buf->body ||
+           (uintptr_t)ptr >= (uintptr_t)buf->body + buf->body_size ||
            size > buf->body_size ||
-           ptr + size > buf->body + buf->body_size) {
+           (uintptr_t)ptr + size > (uintptr_t)buf->body + buf->body_size) {
                return true;
        }
        return false;
@@ -669,7 +669,7 @@ NTSTATUS smb2_push_o16s16_string(struct smb2_request_buffer *buf,
        }
 
        if (*str == 0) {
-               blob.data = str;
+               blob.data = discard_const(str);
                blob.length = 0;
                return smb2_push_o16s16_blob(buf, ofs, blob);
        }

diff --git a/source4/smb_server/smb/request.c b/source4/smb_server/smb/request.c
index 87073517ddcdf799d2d230fff8ba8a1935ec708a..c7fa2d7d8abca1959b121b2c961d5c9bc20b90ef 100644 (file)
--- a/source4/smb_server/smb/request.c
+++ b/source4/smb_server/smb/request.c
@@ -651,10 +651,10 @@ bool req_data_oob(struct request_bufinfo *bufinfo, const uint8_t *ptr, uint32_t
        }
        
        /* be careful with wraparound! */
-       if (ptr < bufinfo->data ||
-           ptr >= bufinfo->data + bufinfo->data_size ||
+       if ((uintptr_t)ptr < (uintptr_t)bufinfo->data ||
+           (uintptr_t)ptr >= (uintptr_t)bufinfo->data + bufinfo->data_size ||
            count > bufinfo->data_size ||
-           ptr + count > bufinfo->data + bufinfo->data_size) {
+           (uintptr_t)ptr + count > (uintptr_t)bufinfo->data + bufinfo->data_size) {
                return true;
        }
        return false;