Skip to content

Commit

Permalink
s4:ntvfs:posix: avoid parsing empty blob in posix_eadb_add_list()
Browse files Browse the repository at this point in the history
Strictly speaking, this is not a bug because parsing loop will just skip
an empty ({NULL}, 0) blob. But it's better to avoid this case because
UBSan (as of clang-17 at least) may complain on such a parsing attempt:

source4/ntvfs/posix/posix_eadb.c:56:62: runtime error: applying zero offset to null pointer
    #0 0x7f9d71ce7b2a in posix_eadb_add_list source4/ntvfs/posix/posix_eadb.c:56
    #1 0x7f9d71ce7b2a in push_xattr_blob_tdb_raw source4/ntvfs/posix/posix_eadb.c:178
    #2 0x7f9d71cec1f5 in py_wrap_setxattr source4/ntvfs/posix/python/pyposix_eadb.c:64
    #3 0x7f9d88bd4507 in cfunction_call (/lib64/libpython3.11.so.1.0+0x1d4507)
    [... a lot of Python calls skipped...]

Signed-off-by: Dmitry Antipov <dantipov@cloudlinux.com>
Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
  • Loading branch information
dmantipov authored and abartlet committed May 9, 2023
1 parent 46ae556 commit 9755206
Showing 1 changed file with 13 additions and 9 deletions.
22 changes: 13 additions & 9 deletions source4/ntvfs/posix/posix_eadb.c
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,6 @@ static NTSTATUS posix_eadb_add_list(struct tdb_wrap *ea_tdb, TALLOC_CTX *ctx, co
{
DATA_BLOB blob;
TALLOC_CTX *mem_ctx;
const char *s;
NTSTATUS status;
size_t len;

Expand All @@ -49,15 +48,20 @@ static NTSTATUS posix_eadb_add_list(struct tdb_wrap *ea_tdb, TALLOC_CTX *ctx, co

status = pull_xattr_blob_tdb_raw(ea_tdb, mem_ctx, XATTR_LIST_ATTR,
fname, fd, 100, &blob);
if (!NT_STATUS_IS_OK(status)) {
blob = data_blob(NULL, 0);
}

for (s=(const char *)blob.data; s < (const char *)(blob.data+blob.length); s += strlen(s) + 1) {
if (strcmp(attr_name, s) == 0) {
talloc_free(mem_ctx);
return NT_STATUS_OK;
if (NT_STATUS_IS_OK(status)) {
const char *s;

for (s = (const char *)blob.data;
s < (const char *)(blob.data + blob.length);
s += strlen(s) + 1) {
if (strcmp(attr_name, s) == 0) {
talloc_free(mem_ctx);
return NT_STATUS_OK;
}
}
} else {
blob = data_blob(NULL, 0);
/* No need to parse an empty blob */
}

len = strlen(attr_name) + 1;
Expand Down

0 comments on commit 9755206

Please sign in to comment.