Skip to content

Commit

Permalink
libgpo: Do not segfault if we don't have a valid security descriptor
Browse files Browse the repository at this point in the history 
Program received signal SIGSEGV, Segmentation fault.
ndr_push_security_descriptor (ndr=ndr@entry=0x555555bf41b0, ndr_flags=ndr_flags@entry=768, r=r@entry=0x0) at librpc/gen_ndr/ndr_security.c:713
713				NDR_CHECK(ndr_push_security_descriptor_revision(ndr, NDR_SCALARS, r->revision));

Thread 1 (Thread 0x7ffff7ece740 (LWP 21460) "python3"):
 #0  ndr_push_security_descriptor (ndr=ndr@entry=0x555555bf41b0, ndr_flags=ndr_flags@entry=768, r=r@entry=0x0) at librpc/gen_ndr/ndr_security.c:713
        _flags_save_STRUCT = 0
        _status = <optimized out>
        _status = <optimized out>
        _status = <optimized out>
        _status = <optimized out>
        _status = <optimized out>
        _status = <optimized out>
        _status = <optimized out>
        _status = <optimized out>
        _status = <optimized out>
        _status = <optimized out>
        _status = <optimized out>
        _status = <optimized out>
        _status = <optimized out>
        _status = <optimized out>
        _status = <optimized out>
        _status = <optimized out>
        _status = <optimized out>
        _status = <optimized out>
        _status = <optimized out>
        _status = <optimized out>
        __FUNCTION__ = "ndr_push_security_descriptor"
 #1  0x00007ffff617237f in ndr_push_struct_blob (blob=blob@entry=0x7fffffffdb20, mem_ctx=0x555555aa3bd0, p=0x0, fn=0x7ffff6074ad0 <ndr_push_security_descriptor>, fn@entry=0x7ffff60706c8 <ndr_push_security_descriptor@plt>) at ../../librpc/ndr/ndr.c:1438
        _status = <optimized out>
        ndr = 0x555555bf41b0
 #2  0x00007ffff607cccf in marshall_sec_desc (mem_ctx=<optimized out>, secdesc=<optimized out>, data=data@entry=0x7fffffffdb80, len=len@entry=0x7fffffffdb78) at ../../libcli/security/secdesc.c:241
        blob = {data = 0x7fffffffdb40 "`\333\377\377\377\177", length = 140737352374299}
        ndr_err = <optimized out>
        __FUNCTION__ = "marshall_sec_desc"
 #3  0x00007ffff29edd94 in GPO_marshall_get_sec_desc_buf (self=<optimized out>, args=<optimized out>, kwds=<optimized out>) at ../../libgpo/pygpo.c:119
        gpo_ptr = <optimized out>
        status = <optimized out>
        data = 0x0
        len = 0

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15599

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: David Mulder <dmulder@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Mar  6 15:44:19 UTC 2024 on atb-devel-224
  • Loading branch information
@cryptomilk
cryptomilk committed Mar 6, 2024
1 parent 6fb86a0 commit b13d435
Showing 1 changed file with 5 additions and 0 deletions.
5 changes: 5 additions & 0 deletions libgpo/pygpo.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,11 @@ static PyObject *GPO_marshall_get_sec_desc_buf(PyObject *self, PyObject *args,
uint8_t *data = NULL;
size_t len = 0;

if (gpo_ptr->security_descriptor == NULL) {
PyErr_SetString(PyExc_RuntimeError, "Uninitialized");
return NULL;
}

status = marshall_sec_desc(gpo_ptr, gpo_ptr->security_descriptor,
&data, &len);
if (!NT_STATUS_IS_OK(status)) {
Expand Down

0 comments on commit b13d435

Please sign in to comment.