From 4820c97e9ea00e73f3188f9834a03913ed74df80 Mon Sep 17 00:00:00 2001 From: Andrew Tridgell Date: Tue, 21 Dec 2010 11:59:54 +1100 Subject: dns: fixed the padding for dnsp_name fields in LDAP all names are NUL terminated, but may have additional padding as well Autobuild-User: Andrew Tridgell Autobuild-Date: Tue Dec 21 03:26:26 CET 2010 on sn-devel-104 --- librpc/ndr/ndr_dnsp.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) (limited to 'librpc/ndr') diff --git a/librpc/ndr/ndr_dnsp.c b/librpc/ndr/ndr_dnsp.c index 77c2366d14..ae78425c55 100644 --- a/librpc/ndr/ndr_dnsp.c +++ b/librpc/ndr/ndr_dnsp.c @@ -36,14 +36,16 @@ _PUBLIC_ void ndr_print_dnsp_name(struct ndr_print *ndr, const char *name, */ _PUBLIC_ enum ndr_err_code ndr_pull_dnsp_name(struct ndr_pull *ndr, int ndr_flags, const char **name) { - uint8_t len, count, final; + uint8_t len, count, termination; int i; - uint32_t total_len; + uint32_t total_len, raw_offset; char *ret; NDR_CHECK(ndr_pull_uint8(ndr, ndr_flags, &len)); NDR_CHECK(ndr_pull_uint8(ndr, ndr_flags, &count)); + raw_offset = ndr->offset; + ret = talloc_strdup(ndr->current_mem_ctx, ""); if (!ret) { return ndr_pull_error(ndr, NDR_ERR_ALLOC, "Failed to pull dnsp"); @@ -68,7 +70,19 @@ _PUBLIC_ enum ndr_err_code ndr_pull_dnsp_name(struct ndr_pull *ndr, int ndr_flag ret[newlen-1] = 0; total_len = newlen; } - NDR_CHECK(ndr_pull_uint8(ndr, ndr_flags, &final)); + NDR_CHECK(ndr_pull_uint8(ndr, ndr_flags, &termination)); + if (termination != 0) { + return ndr_pull_error(ndr, NDR_ERR_ALLOC, "Failed to pull dnsp - not NUL terminated"); + } + if (ndr->offset > raw_offset + len) { + return ndr_pull_error(ndr, NDR_ERR_ALLOC, "Failed to pull dnsp - overrun by %u bytes", + ndr->offset - (raw_offset + len)); + } + /* there could be additional pad bytes */ + while (ndr->offset < raw_offset + len) { + uint8_t pad; + NDR_CHECK(ndr_pull_uint8(ndr, ndr_flags, &pad)); + } (*name) = ret; return NDR_ERR_SUCCESS; } @@ -81,7 +95,7 @@ enum ndr_err_code ndr_push_dnsp_name(struct ndr_push *ndr, int ndr_flags, const for (count=i=0; name[i]; i++) { if (name[i] == '.') count++; } - total_len = strlen(name) + 1; + total_len = strlen(name) + 1 + 1; if (total_len > 255 || count > 255) { return ndr_push_error(ndr, NDR_ERR_BUFSIZE, "dns_name of length %d larger than 255", total_len); -- cgit