← Back to branch summary

~ubuntu-branches/ubuntu/oneiric/samba/oneiric-security

« back to all changes in this revision

Viewing changes to source3/librpc/gen_ndr/ndr_notify.c

  • Committer: Package Import Robot
  • Author(s): Tyler Hicks
  • Date: 2012-04-12 05:28:44 UTC
  • mfrom: (147.1.1 oneiric-proposed)
  • Revision ID: package-import@ubuntu.com-20120412052844-348q6l4dcb303sdu
Tags: 2:3.5.11~dfsg-1ubuntu2.2
https://launchpad.net/bugs/978458
* SECURITY UPDATE: Unauthenticated remote code execution via
  RPC calls (LP: #978458)
  - debian/patches/CVE-2012-1182-1.patch: Fix PIDL compiler to generate code
    that uses the same value for array allocation and array length checks.
    Based on upstream patch.
  - debian/patches/CVE-2012-1182-2.patch: Regenerate PIDL generated files with
    the patched PIDL compiler
  - CVE-2012-1182

Show diffs side-by-side

added added

removed removed

Lines of Context:
source3/librpc/gen_ndr/ndr_notify.c
91
91
 
92
92
_PUBLIC_ enum ndr_err_code ndr_pull_notify_entry_array(struct ndr_pull *ndr, int ndr_flags, struct notify_entry_array *r)
93
93
{
 
94
        uint32_t size_entries_0 = 0;
94
95
        uint32_t cntr_entries_0;
95
96
        TALLOC_CTX *_mem_save_entries_0;
96
97
        if (ndr_flags & NDR_SCALARS) {
97
98
                NDR_CHECK(ndr_pull_align(ndr, 8));
98
99
                NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->num_entries));
99
 
                NDR_PULL_ALLOC_N(ndr, r->entries, r->num_entries);
 
100
                size_entries_0 = r->num_entries;
 
101
                NDR_PULL_ALLOC_N(ndr, r->entries, size_entries_0);
100
102
                _mem_save_entries_0 = NDR_PULL_GET_MEM_CTX(ndr);
101
103
                NDR_PULL_SET_MEM_CTX(ndr, r->entries, 0);
102
 
                for (cntr_entries_0 = 0; cntr_entries_0 < r->num_entries; cntr_entries_0++) {
 
104
                for (cntr_entries_0 = 0; cntr_entries_0 < size_entries_0; cntr_entries_0++) {
103
105
                        NDR_CHECK(ndr_pull_notify_entry(ndr, NDR_SCALARS, &r->entries[cntr_entries_0]));
104
106
                }
105
107
                NDR_PULL_SET_MEM_CTX(ndr, _mem_save_entries_0, 0);
106
108
                NDR_CHECK(ndr_pull_trailer_align(ndr, 8));
107
109
        }
108
110
        if (ndr_flags & NDR_BUFFERS) {
 
111
                size_entries_0 = r->num_entries;
109
112
                _mem_save_entries_0 = NDR_PULL_GET_MEM_CTX(ndr);
110
113
                NDR_PULL_SET_MEM_CTX(ndr, r->entries, 0);
111
 
                for (cntr_entries_0 = 0; cntr_entries_0 < r->num_entries; cntr_entries_0++) {
 
114
                for (cntr_entries_0 = 0; cntr_entries_0 < size_entries_0; cntr_entries_0++) {
112
115
                        NDR_CHECK(ndr_pull_notify_entry(ndr, NDR_BUFFERS, &r->entries[cntr_entries_0]));
113
116
                }
114
117
                NDR_PULL_SET_MEM_CTX(ndr, _mem_save_entries_0, 0);
158
161
 
159
162
static enum ndr_err_code ndr_pull_notify_depth(struct ndr_pull *ndr, int ndr_flags, struct notify_depth *r)
160
163
{
 
164
        uint32_t size_entries_0 = 0;
161
165
        uint32_t cntr_entries_0;
162
166
        TALLOC_CTX *_mem_save_entries_0;
163
167
        if (ndr_flags & NDR_SCALARS) {
165
169
                NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->max_mask));
166
170
                NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->max_mask_subdir));
167
171
                NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->num_entries));
168
 
                NDR_PULL_ALLOC_N(ndr, r->entries, r->num_entries);
 
172
                size_entries_0 = r->num_entries;
 
173
                NDR_PULL_ALLOC_N(ndr, r->entries, size_entries_0);
169
174
                _mem_save_entries_0 = NDR_PULL_GET_MEM_CTX(ndr);
170
175
                NDR_PULL_SET_MEM_CTX(ndr, r->entries, 0);
171
 
                for (cntr_entries_0 = 0; cntr_entries_0 < r->num_entries; cntr_entries_0++) {
 
176
                for (cntr_entries_0 = 0; cntr_entries_0 < size_entries_0; cntr_entries_0++) {
172
177
                        NDR_CHECK(ndr_pull_notify_entry(ndr, NDR_SCALARS, &r->entries[cntr_entries_0]));
173
178
                }
174
179
                NDR_PULL_SET_MEM_CTX(ndr, _mem_save_entries_0, 0);
175
180
                NDR_CHECK(ndr_pull_trailer_align(ndr, 8));
176
181
        }
177
182
        if (ndr_flags & NDR_BUFFERS) {
 
183
                size_entries_0 = r->num_entries;
178
184
                _mem_save_entries_0 = NDR_PULL_GET_MEM_CTX(ndr);
179
185
                NDR_PULL_SET_MEM_CTX(ndr, r->entries, 0);
180
 
                for (cntr_entries_0 = 0; cntr_entries_0 < r->num_entries; cntr_entries_0++) {
 
186
                for (cntr_entries_0 = 0; cntr_entries_0 < size_entries_0; cntr_entries_0++) {
181
187
                        NDR_CHECK(ndr_pull_notify_entry(ndr, NDR_BUFFERS, &r->entries[cntr_entries_0]));
182
188
                }
183
189
                NDR_PULL_SET_MEM_CTX(ndr, _mem_save_entries_0, 0);
227
233
 
228
234
_PUBLIC_ enum ndr_err_code ndr_pull_notify_array(struct ndr_pull *ndr, int ndr_flags, struct notify_array *r)
229
235
{
 
236
        uint32_t size_depth_0 = 0;
230
237
        uint32_t cntr_depth_0;
231
238
        TALLOC_CTX *_mem_save_depth_0;
232
239
        if (ndr_flags & NDR_SCALARS) {
233
240
                NDR_CHECK(ndr_pull_align(ndr, 8));
234
241
                NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->num_depths));
235
 
                NDR_PULL_ALLOC_N(ndr, r->depth, r->num_depths);
 
242
                size_depth_0 = r->num_depths;
 
243
                NDR_PULL_ALLOC_N(ndr, r->depth, size_depth_0);
236
244
                _mem_save_depth_0 = NDR_PULL_GET_MEM_CTX(ndr);
237
245
                NDR_PULL_SET_MEM_CTX(ndr, r->depth, 0);
238
 
                for (cntr_depth_0 = 0; cntr_depth_0 < r->num_depths; cntr_depth_0++) {
 
246
                for (cntr_depth_0 = 0; cntr_depth_0 < size_depth_0; cntr_depth_0++) {
239
247
                        NDR_CHECK(ndr_pull_notify_depth(ndr, NDR_SCALARS, &r->depth[cntr_depth_0]));
240
248
                }
241
249
                NDR_PULL_SET_MEM_CTX(ndr, _mem_save_depth_0, 0);
242
250
                NDR_CHECK(ndr_pull_trailer_align(ndr, 8));
243
251
        }
244
252
        if (ndr_flags & NDR_BUFFERS) {
 
253
                size_depth_0 = r->num_depths;
245
254
                _mem_save_depth_0 = NDR_PULL_GET_MEM_CTX(ndr);
246
255
                NDR_PULL_SET_MEM_CTX(ndr, r->depth, 0);
247
 
                for (cntr_depth_0 = 0; cntr_depth_0 < r->num_depths; cntr_depth_0++) {
 
256
                for (cntr_depth_0 = 0; cntr_depth_0 < size_depth_0; cntr_depth_0++) {
248
257
                        NDR_CHECK(ndr_pull_notify_depth(ndr, NDR_BUFFERS, &r->depth[cntr_depth_0]));
249
258
                }
250
259
                NDR_PULL_SET_MEM_CTX(ndr, _mem_save_depth_0, 0);