edc1f6e252
idl: drsuapi_DsaAddressListItem_V1 limit recursion idl: limit recurion on recursive-elements lib: ldb Limit depth of ldb_parse_tree librpc: ndr add recursion check macros librpc: ndr Heap-buffer-overflow in lzxpress_decompress librpc: ndr NDR_PULL_ALIGN check for unsigned overflow lzxpress: add bounds checking to lzxpress decompress lzxpress: avoid technically undefined shift pidl: Add recursive depth checks utils: asn1 avoid undefined behaviour witness: idl fix length calculation for witness_IPaddrInfoList
39 lines
1.2 KiB
Diff
39 lines
1.2 KiB
Diff
From ed9abf94b3167a1a61b5da163e9b07b06c8a457b Mon Sep 17 00:00:00 2001
|
|
From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
|
|
Date: Sun, 6 Sep 2020 09:35:49 +1200
|
|
Subject: [PATCH] utils/asn1: avoid undefined behaviour warning
|
|
|
|
UBSAN does not like an int >= 1<<24 being shifted left.
|
|
We check the overflow in the very next line.
|
|
|
|
Credit to OSS-Fuzz.
|
|
|
|
REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25436
|
|
|
|
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
|
|
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
|
|
|
|
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
|
|
Autobuild-Date(master): Fri Sep 11 05:05:59 UTC 2020 on sn-devel-184
|
|
---
|
|
lib/util/asn1.c | 6 +++++-
|
|
1 file changed, 5 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/lib/util/asn1.c b/lib/util/asn1.c
|
|
index 6b1b4bc2877f..9ab9e1b08449 100644
|
|
--- a/lib/util/asn1.c
|
|
+++ b/lib/util/asn1.c
|
|
@@ -1071,7 +1071,11 @@ bool asn1_read_enumerated(struct asn1_data *data, int *v)
|
|
if (!asn1_read_uint8(data, &b)) {
|
|
return false;
|
|
}
|
|
- *v = (*v << 8) + b;
|
|
+ /*
|
|
+ * To please/fool the Undefined Behaviour Sanitizer we cast to
|
|
+ * unsigned for the left shift.
|
|
+ */
|
|
+ *v = ((unsigned int)*v << 8) + b;
|
|
}
|
|
return asn1_end_tag(data);
|
|
}
|