RPC parsing fixes - Githubissues

namjaejeon / ksmbd-tools

ksmbd kernel server userspace utilities

GNU General Public License v2.0

55 stars 43 forks source link

RPC parsing fixes #186

Closed mmakassikis closed 2 years ago

mmakassikis commented 2 years ago

It is possible to crash ksmbd.mountd by sending invalid RPC requests.

This series adds some missing checks that fix crashes turned up by fuzzing the RPC code. The last commit is quite large as callers to ndrwrite* functions are modifed to check the return value and exit early. This is a mechanical change, but it's possible I missed something in the process.

mmakassikis commented 2 years ago

I pushed an updated version:

fix invalid free in "ksmbd-tools: mountd: validate RPC request"
additional fixes for set_domain_name()

mmakassikis commented 2 years ago

Updated the branch:

replaced strcpy() with snprintf() in set_domain_name(), and updated snprintf error checking (previously, we only checked for overflow)
removed req->payload_sz overwriting
minimized the use of intermediate 'ret' variable when checking ndrwrite* return
added some more ndrwrite* checks that were missing
added check for rpc_samr_init() / rpc_lsarpc_init() in rpc_init()

namjaejeon commented 2 years ago

Applied. Thanks for your patches!