67 lines
2.3 KiB
Diff
67 lines
2.3 KiB
Diff
|
From ee3156c76b86c11829f6f3fe1e3c940b45899c56 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Gary Lockyer <gary@catalyst.net.nz>
|
||
|
|
Date: Wed, 8 Apr 2020 10:46:44 +1200
|
||
|
|
Subject: [PATCH 8/8] CVE-2020-10704 libcli ldap: Check search request lengths.
|
||
|
|
|
||
|
|
Check the search request lengths against the limits passed to
|
||
|
|
ldap_decode.
|
||
|
|
|
||
|
|
Credit to OSS-Fuzz
|
||
|
|
|
||
|
|
REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
|
||
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334
|
||
|
|
|
||
|
|
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
|
||
|
|
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
|
||
|
|
---
|
||
|
|
lib/util/asn1.c | 7 +++++++
|
||
|
|
lib/util/asn1.h | 1 +
|
||
|
|
libcli/ldap/ldap_message.c | 4 ++++
|
||
|
|
3 files changed, 12 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/lib/util/asn1.c b/lib/util/asn1.c
|
||
|
|
index ee3cff9cb65..32d7981d28f 100644
|
||
|
|
--- a/lib/util/asn1.c
|
||
|
|
+++ b/lib/util/asn1.c
|
||
|
|
@@ -1159,3 +1159,10 @@ int asn1_peek_full_tag(DATA_BLOB blob, uint8_t tag, size_t *packet_size)
|
||
|
|
*packet_size = size;
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
+
|
||
|
|
+/*
|
||
|
|
+ * Get the length of the ASN.1 data
|
||
|
|
+ */
|
||
|
|
+size_t asn1_get_length(const struct asn1_data *asn1) {
|
||
|
|
+ return asn1->length;
|
||
|
|
+}
|
||
|
|
diff --git a/lib/util/asn1.h b/lib/util/asn1.h
|
||
|
|
index fc365724e93..de92a767f14 100644
|
||
|
|
--- a/lib/util/asn1.h
|
||
|
|
+++ b/lib/util/asn1.h
|
||
|
|
@@ -106,5 +106,6 @@ bool asn1_extract_blob(struct asn1_data *asn1, TALLOC_CTX *mem_ctx,
|
||
|
|
DATA_BLOB *pblob);
|
||
|
|
void asn1_load_nocopy(struct asn1_data *data, uint8_t *buf, size_t len);
|
||
|
|
int asn1_peek_full_tag(DATA_BLOB blob, uint8_t tag, size_t *packet_size);
|
||
|
|
+size_t asn1_get_length(const struct asn1_data *asn1);
|
||
|
|
|
||
|
|
#endif /* _ASN_1_H */
|
||
|
|
diff --git a/libcli/ldap/ldap_message.c b/libcli/ldap/ldap_message.c
|
||
|
|
index d38fa0b3b61..69a48279532 100644
|
||
|
|
--- a/libcli/ldap/ldap_message.c
|
||
|
|
+++ b/libcli/ldap/ldap_message.c
|
||
|
|
@@ -1259,7 +1259,11 @@ _PUBLIC_ NTSTATUS ldap_decode(struct asn1_data *data,
|
||
|
|
struct ldap_SearchRequest *r = &msg->r.SearchRequest;
|
||
|
|
int sizelimit, timelimit;
|
||
|
|
const char **attrs = NULL;
|
||
|
|
+ size_t request_size = asn1_get_length(data);
|
||
|
|
msg->type = LDAP_TAG_SearchRequest;
|
||
|
|
+ if (request_size > limits->max_search_size) {
|
||
|
|
+ goto prot_err;
|
||
|
|
+ }
|
||
|
|
if (!asn1_start_tag(data, tag)) goto prot_err;
|
||
|
|
if (!asn1_read_OctetString_talloc(msg, data, &r->basedn)) goto prot_err;
|
||
|
|
if (!asn1_read_enumerated(data, (int *)(void *)&(r->scope))) goto prot_err;
|
||
|
|
--
|
||
|
|
2.17.1
|
||
|
|
|