diff options
| author | Andrew Walker <awalker@ixsystems.com> | 2022-12-27 10:59:14 -0500 |
|---|---|---|
| committer | Jule Anger <janger@samba.org> | 2023-01-23 10:27:59 +0000 |
| commit | 85331e00b6f41171c239fec0593b0c1ca133e9a6 (patch) | |
| tree | 5fded2075d59ed564088255c5e34b1d71b018052 | |
| parent | f0729d7a72d4297a04faf8b20d2ea1a34aa70940 (diff) | |
| download | samba-85331e00b6f41171c239fec0593b0c1ca133e9a6.tar.gz | |
lib/replace - add extra check to bsd_attr_list
The FreeBSD extattr API may return success and truncated
namelist. We need to check for this in bsd_attr_list to
ensure that we don't accidentally read off the end of the
buffer. In the case of a truncated value, the pascal
strings for attr names will reflect the lengths as if
the value were not truncated. For example:
`58DosStrea`
In case of short read we now set error to ERANGE and
fail.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15271
Signed-off-by: Andrew Walker <awalker@ixsystems.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Mon Jan 2 14:27:23 UTC 2023 on sn-devel-184
(cherry picked from commit 01cdc5e00be78a51f0766634cc7fe50de2088203)
Autobuild-User(v4-17-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-17-test): Mon Jan 23 10:27:59 UTC 2023 on sn-devel-184
| -rw-r--r-- | lib/replace/xattr.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/lib/replace/xattr.c b/lib/replace/xattr.c index 4869367b7da..1044942f4b9 100644 --- a/lib/replace/xattr.c +++ b/lib/replace/xattr.c @@ -267,6 +267,18 @@ static ssize_t bsd_attr_list (int type, extattr_arg arg, char *list, size_t size for(i = 0; i < list_size; i += len + 1) { len = buf[i]; + + /* + * If for some reason we receive a truncated + * return from call to list xattrs the pascal + * string lengths will not be changed and + * therefore we must check that we're not + * reading garbage data or off end of array + */ + if (len + i >= list_size) { + errno = ERANGE; + return -1; + } strncpy(list, extattr[t].name, extattr[t].len + 1); list += extattr[t].len; strncpy(list, buf + i + 1, len); |