CVE-2016-2123: Fix DNS vuln ZDI-CAN-3995

Thanks to Trend Micro's Zero Day Initiative and Frederic Besler for finding
this vulnerability with a PoC and a good analysis.

Signed-off-by: Volker Lendecke <vl@samba.org>
Bug: https://bugzilla.samba.org/show_bug.cgi?id=12409

diff --git a/librpc/ndr/ndr_dnsp.c b/librpc/ndr/ndr_dnsp.c
index ff77bc7da6d52b64dd034de4267c162c831c0b63..974ff5ebff2c7f1f96fa20d0e5378ad9a5c3c37b 100644 (file)
--- a/librpc/ndr/ndr_dnsp.c
+++ b/librpc/ndr/ndr_dnsp.c
@@ -56,7 +56,16 @@ _PUBLIC_ enum ndr_err_code ndr_pull_dnsp_name(struct ndr_pull *ndr, int ndr_flag
                uint8_t sublen, newlen;
                NDR_CHECK(ndr_pull_uint8(ndr, ndr_flags, &sublen));
                newlen = total_len + sublen;
+               if (newlen < total_len) {
+                       return ndr_pull_error(ndr, NDR_ERR_RANGE,
+                                             "Failed to pull dnsp_name");
+               }
                if (i != count-1) {
+                       if (newlen == UINT8_MAX) {
+                               return ndr_pull_error(
+                                       ndr, NDR_ERR_RANGE,
+                                       "Failed to pull dnsp_name");
+                       }
                        newlen++; /* for the '.' */
                }
                ret = talloc_realloc(ndr->current_mem_ctx, ret, char, newlen);