← Back to branch summary

~ubuntu-branches/ubuntu/quantal/samba/quantal

« back to all changes in this revision

Viewing changes to source3/librpc/gen_ndr/ndr_orpc.c

  • Committer: Package Import Robot
  • Author(s): Tyler Hicks
  • Date: 2012-04-12 05:28:44 UTC
  • Revision ID: package-import@ubuntu.com-20120412052844-i2u39y7vkrcx61u4
Tags: 2:3.6.3-2ubuntu2
https://launchpad.net/bugs/978458
* SECURITY UPDATE: Unauthenticated remote code execution via
  RPC calls (LP: #978458)
  - debian/patches/CVE-2012-1182-1.patch: Fix PIDL compiler to generate code
    that uses the same value for array allocation and array length checks.
    Based on upstream patch.
  - debian/patches/CVE-2012-1182-2.patch: Regenerate PIDL generated files
    with the patched PIDL compiler
  - CVE-2012-1182

Show diffs side-by-side

added added

removed removed

Lines of Context:
source3/librpc/gen_ndr/ndr_orpc.c
57
57
 
58
58
_PUBLIC_ enum ndr_err_code ndr_pull_ORPC_EXTENT(struct ndr_pull *ndr, int ndr_flags, struct ORPC_EXTENT *r)
59
59
{
 
60
        uint32_t size_data_0 = 0;
60
61
        if (ndr_flags & NDR_SCALARS) {
61
62
                NDR_CHECK(ndr_pull_array_size(ndr, &r->data));
62
63
                NDR_CHECK(ndr_pull_align(ndr, 4));
63
64
                NDR_CHECK(ndr_pull_GUID(ndr, NDR_SCALARS, &r->id));
64
65
                NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->size));
65
 
                NDR_PULL_ALLOC_N(ndr, r->data, ndr_get_array_size(ndr, &r->data));
66
 
                NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data, ndr_get_array_size(ndr, &r->data)));
 
66
                size_data_0 = ndr_get_array_size(ndr, &r->data);
 
67
                NDR_PULL_ALLOC_N(ndr, r->data, size_data_0);
 
68
                NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data, size_data_0));
67
69
                if (r->data) {
68
70
                        NDR_CHECK(ndr_check_array_size(ndr, (void*)&r->data, ((r->size + 7) & ~7)));
69
71
                }
114
116
static enum ndr_err_code ndr_pull_ORPC_EXTENT_ARRAY(struct ndr_pull *ndr, int ndr_flags, struct ORPC_EXTENT_ARRAY *r)
115
117
{
116
118
        uint32_t _ptr_extent;
 
119
        uint32_t size_extent_1 = 0;
117
120
        uint32_t cntr_extent_1;
118
121
        TALLOC_CTX *_mem_save_extent_0;
119
122
        TALLOC_CTX *_mem_save_extent_1;
135
138
                        _mem_save_extent_0 = NDR_PULL_GET_MEM_CTX(ndr);
136
139
                        NDR_PULL_SET_MEM_CTX(ndr, r->extent, 0);
137
140
                        NDR_CHECK(ndr_pull_array_size(ndr, &r->extent));
138
 
                        NDR_PULL_ALLOC_N(ndr, r->extent, ndr_get_array_size(ndr, &r->extent));
 
141
                        size_extent_1 = ndr_get_array_size(ndr, &r->extent);
 
142
                        NDR_PULL_ALLOC_N(ndr, r->extent, size_extent_1);
139
143
                        _mem_save_extent_1 = NDR_PULL_GET_MEM_CTX(ndr);
140
144
                        NDR_PULL_SET_MEM_CTX(ndr, r->extent, 0);
141
 
                        for (cntr_extent_1 = 0; cntr_extent_1 < ((r->size + 1) & ~1); cntr_extent_1++) {
 
145
                        for (cntr_extent_1 = 0; cntr_extent_1 < size_extent_1; cntr_extent_1++) {
142
146
                                NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_extent));
143
147
                                if (_ptr_extent) {
144
148
                                        NDR_PULL_ALLOC(ndr, r->extent[cntr_extent_1]);
146
150
                                        r->extent[cntr_extent_1] = NULL;
147
151
                                }
148
152
                        }
149
 
                        for (cntr_extent_1 = 0; cntr_extent_1 < ((r->size + 1) & ~1); cntr_extent_1++) {
 
153
                        for (cntr_extent_1 = 0; cntr_extent_1 < size_extent_1; cntr_extent_1++) {
150
154
                                if (r->extent[cntr_extent_1]) {
151
155
                                        _mem_save_extent_2 = NDR_PULL_GET_MEM_CTX(ndr);
152
156
                                        NDR_PULL_SET_MEM_CTX(ndr, r->extent[cntr_extent_1], 0);
580
584
 
581
585
static enum ndr_err_code ndr_pull_u_custom(struct ndr_pull *ndr, int ndr_flags, struct u_custom *r)
582
586
{
 
587
        uint32_t size_pData_0 = 0;
583
588
        if (ndr_flags & NDR_SCALARS) {
584
589
                NDR_CHECK(ndr_pull_align(ndr, 4));
585
590
                NDR_CHECK(ndr_pull_GUID(ndr, NDR_SCALARS, &r->clsid));
586
591
                NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->cbExtension));
587
592
                NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->size));
588
 
                NDR_PULL_ALLOC_N(ndr, r->pData, r->size);
589
 
                NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->pData, r->size));
 
593
                size_pData_0 = r->size;
 
594
                NDR_PULL_ALLOC_N(ndr, r->pData, size_pData_0);
 
595
                NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->pData, size_pData_0));
590
596
                NDR_CHECK(ndr_pull_trailer_align(ndr, 4));
591
597
        }
592
598
        if (ndr_flags & NDR_BUFFERS) {