Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Validate size of ace_count in FPSetACL request #546

Merged
merged 1 commit into from
Oct 21, 2023
Merged

Conversation

rdmark
Copy link
Member

@rdmark rdmark commented Oct 21, 2023

Avoiding a potential buffer overrun if the value is too large

Credits: Robert Morris

@rdmark
Copy link
Member Author

rdmark commented Oct 21, 2023

Keeping this as Draft until it can be properly tested

@rdmark rdmark marked this pull request as ready for review October 21, 2023 12:15
@rdmark
Copy link
Member Author

rdmark commented Oct 21, 2023

Did a smoketest on Ubuntu 22.04.3 -- the ext4 file system has ACLs enabled. The afp_setacl function is called in the UAM_AFPSERVER_POSTAUTH phase. Authentication and connection to the shared volume works without error.

Beyond that, more ACL scenarios should probably be tested, but I have no use cases/experiences with ACLs myself. Ideas welcome!

Signed-off-by: Robert Morris
Reviewed-by: Daniel Markstedt <daniel@mindani.net>
@rdmark rdmark merged commit 007162d into main Oct 21, 2023
3 checks passed
@rdmark rdmark deleted the rdmark-issue-364 branch October 21, 2023 22:31
@rdmark
Copy link
Member Author

rdmark commented Oct 21, 2023

Backported to 2.x #551

@sonarcloud
Copy link

sonarcloud bot commented Oct 21, 2023

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

0.0% 0.0% Coverage
0.0% 0.0% Duplication

warning The version of Java (11.0.17) you have used to run this analysis is deprecated and we will stop accepting it soon. Please update to at least Java 17.
Read more here

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants