svn commit: samba r18989 - in branches/SAMBA_4_0/source: ldap_server libcli/ldap libcli/util

[abartlet at samba.org]

Author: abartlet
Date: 2006-09-29 04:45:15 +0000 (Fri, 29 Sep 2006)
New Revision: 18989

WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=18989

Log:
Fixes found by these two LDAP testsuites:
- http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/
- http://gleg.net/protover_ldap_sample.shtml

Also fixes found by a subsequent audit of the code for similar issues.


Modified:
   branches/SAMBA_4_0/source/ldap_server/ldap_backend.c
   branches/SAMBA_4_0/source/libcli/ldap/ldap.c
   branches/SAMBA_4_0/source/libcli/util/asn1.c


Changeset:
Modified: branches/SAMBA_4_0/source/ldap_server/ldap_backend.c
===================================================================
--- branches/SAMBA_4_0/source/ldap_server/ldap_backend.c	2006-09-29 01:49:26 UTC (rev 18988)
+++ branches/SAMBA_4_0/source/ldap_server/ldap_backend.c	2006-09-29 04:45:15 UTC (rev 18989)
@@ -220,6 +220,10 @@
 			scope = LDB_SCOPE_SUBTREE;
 			success_limit = 0;
 			break;
+	        default:
+			result = LDAP_PROTOCOL_ERROR;
+			errstr = "Invalid scope";
+			break;
 	}
 
 	if (req->num_attributes >= 1) {

Modified: branches/SAMBA_4_0/source/libcli/ldap/ldap.c
===================================================================
--- branches/SAMBA_4_0/source/libcli/ldap/ldap.c	2006-09-29 01:49:26 UTC (rev 18988)
+++ branches/SAMBA_4_0/source/libcli/ldap/ldap.c	2006-09-29 04:45:15 UTC (rev 18989)
@@ -949,8 +949,14 @@
 			r->mechanism = LDAP_AUTH_MECH_SIMPLE;
 			asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(0));
 			pwlen = asn1_tag_remaining(data);
+			if (pwlen == -1) {
+				return False;
+			}
 			if (pwlen != 0) {
 				char *pw = talloc_size(msg, pwlen+1);
+				if (!pw) {
+					return False;
+				}
 				asn1_read(data, pw, pwlen);
 				pw[pwlen] = '\0';
 				r->creds.password = pw;
@@ -974,6 +980,9 @@
 				r->creds.SASL.secblob = NULL;
 			}
 			asn1_end_tag(data);
+		} else {
+			/* Neither Simple nor SASL bind */
+			return False;
 		}
 		asn1_end_tag(data);
 		break;
@@ -1096,8 +1105,9 @@
 			ldap_decode_attrib(msg, data, &mod.attrib);
 			asn1_end_tag(data);
 			if (!add_mod_to_array_talloc(msg, &mod,
-						     &r->mods, &r->num_mods))
-				break;
+						     &r->mods, &r->num_mods)) {
+				return False;
+			}
 		}
 
 		asn1_end_tag(data);
@@ -1146,6 +1156,9 @@
 		asn1_start_tag(data,
 			       ASN1_APPLICATION_SIMPLE(LDAP_TAG_DelRequest));
 		len = asn1_tag_remaining(data);
+		if (len == -1) {
+			return False;
+		}
 		dn = talloc_size(msg, len+1);
 		if (dn == NULL)
 			break;
@@ -1179,9 +1192,13 @@
 			char *newsup;
 			asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(0));
 			len = asn1_tag_remaining(data);
+			if (len == -1) {
+				return False;
+			}
 			newsup = talloc_size(msg, len+1);
-			if (newsup == NULL)
-				break;
+			if (newsup == NULL) {
+				return False;
+			}
 			asn1_read(data, newsup, len);
 			newsup[len] = '\0';
 			r->newsuperior = newsup;

Modified: branches/SAMBA_4_0/source/libcli/util/asn1.c
===================================================================
--- branches/SAMBA_4_0/source/libcli/util/asn1.c	2006-09-29 01:49:26 UTC (rev 18988)
+++ branches/SAMBA_4_0/source/libcli/util/asn1.c	2006-09-29 04:45:15 UTC (rev 18989)
@@ -396,6 +396,9 @@
 	nesting->start = data->ofs;
 	nesting->next = data->nesting;
 	data->nesting = nesting;
+	if (asn1_tag_remaining(data) == -1) {
+		return False;
+	}
 	return !data->has_error;
 }
 
@@ -426,11 +429,21 @@
 /* work out how many bytes are left in this nested tag */
 int asn1_tag_remaining(struct asn1_data *data)
 {
+	int remaining;
+	if (data->has_error) {
+		return -1;
+	}
+
 	if (!data->nesting) {
 		data->has_error = True;
 		return -1;
 	}
-	return data->nesting->taglen - (data->ofs - data->nesting->start);
+	remaining = data->nesting->taglen - (data->ofs - data->nesting->start);
+	if (remaining > (data->length - data->ofs)) {
+		data->has_error = True;
+		return -1;
+	}
+	return remaining;
 }
 
 /* read an object ID from a ASN1 buffer */
@@ -518,6 +531,10 @@
 		return False;
 	}
 	*blob = data_blob(NULL, len+1);
+	if (!blob->data) {
+		data->has_error = True;
+		return False;
+	}
 	asn1_read(data, blob->data, len);
 	asn1_end_tag(data);
 	blob->length--;
@@ -542,6 +559,10 @@
 		return False;
 	}
 	*blob = data_blob(NULL, len);
+	if (!blob->data) {
+		data->has_error = True;
+		return False;
+	}
 	asn1_read(data, blob->data, len);
 	asn1_end_tag(data);
 	return !data->has_error;