|
 |
1524bc |
From 588b74189958630b39cb393c47495d39dead83a1 Mon Sep 17 00:00:00 2001
|
|
|
1524bc |
From: Andrew Bartlett <abartlet@samba.org>
|
|
|
1524bc |
Date: Fri, 29 Nov 2019 20:58:47 +1300
|
|
|
1524bc |
Subject: [PATCH] CVE-2019-14907 lib/util: Do not print the failed to convert
|
|
|
1524bc |
string into the logs
|
|
|
1524bc |
MIME-Version: 1.0
|
|
|
1524bc |
Content-Type: text/plain; charset=UTF-8
|
|
|
1524bc |
Content-Transfer-Encoding: 8bit
|
|
|
1524bc |
|
|
|
1524bc |
The string may be in another charset, or may be sensitive and
|
|
|
1524bc |
certainly may not be terminated. It is not safe to just print.
|
|
|
1524bc |
|
|
|
1524bc |
Found by Robert Święcki using a fuzzer he wrote for smbd.
|
|
|
1524bc |
|
|
|
1524bc |
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14208
|
|
|
1524bc |
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
|
|
|
1524bc |
---
|
|
|
1524bc |
lib/util/charset/convert_string.c | 38 ++++++++++++++++---------------
|
|
|
1524bc |
1 file changed, 20 insertions(+), 18 deletions(-)
|
|
|
1524bc |
|
|
|
1524bc |
diff --git a/lib/util/charset/convert_string.c b/lib/util/charset/convert_string.c
|
|
|
1524bc |
index d274e305a0c..b725b53cb5a 100644
|
|
|
1524bc |
--- a/lib/util/charset/convert_string.c
|
|
|
1524bc |
+++ b/lib/util/charset/convert_string.c
|
|
|
1524bc |
@@ -293,31 +293,31 @@ bool convert_string_handle(struct smb_iconv_handle *ic,
|
|
|
1524bc |
switch(errno) {
|
|
|
1524bc |
case EINVAL:
|
|
|
1524bc |
reason="Incomplete multibyte sequence";
|
|
|
1524bc |
- DEBUG(3,("convert_string_internal: Conversion error: %s(%s)\n",
|
|
|
1524bc |
- reason, (const char *)src));
|
|
|
1524bc |
+ DBG_NOTICE("Conversion error: %s\n",
|
|
|
1524bc |
+ reason);
|
|
|
1524bc |
break;
|
|
|
1524bc |
case E2BIG:
|
|
|
1524bc |
{
|
|
|
1524bc |
reason="No more room";
|
|
|
1524bc |
if (from == CH_UNIX) {
|
|
|
1524bc |
- DEBUG(3,("E2BIG: convert_string(%s,%s): srclen=%u destlen=%u - '%s' error: %s\n",
|
|
|
1524bc |
- charset_name(ic, from), charset_name(ic, to),
|
|
|
1524bc |
- (unsigned int)srclen, (unsigned int)destlen, (const char *)src, reason));
|
|
|
1524bc |
+ DBG_NOTICE("E2BIG: convert_string(%s,%s): srclen=%u destlen=%u error: %s\n",
|
|
|
1524bc |
+ charset_name(ic, from), charset_name(ic, to),
|
|
|
1524bc |
+ (unsigned int)srclen, (unsigned int)destlen, reason);
|
|
|
1524bc |
} else {
|
|
|
1524bc |
- DEBUG(3,("E2BIG: convert_string(%s,%s): srclen=%u destlen=%u error: %s\n",
|
|
|
1524bc |
- charset_name(ic, from), charset_name(ic, to),
|
|
|
1524bc |
- (unsigned int)srclen, (unsigned int)destlen, reason));
|
|
|
1524bc |
+ DBG_NOTICE("E2BIG: convert_string(%s,%s): srclen=%u destlen=%u error: %s\n",
|
|
|
1524bc |
+ charset_name(ic, from), charset_name(ic, to),
|
|
|
1524bc |
+ (unsigned int)srclen, (unsigned int)destlen, reason);
|
|
|
1524bc |
}
|
|
|
1524bc |
break;
|
|
|
1524bc |
}
|
|
|
1524bc |
case EILSEQ:
|
|
|
1524bc |
reason="Illegal multibyte sequence";
|
|
|
1524bc |
- DEBUG(3,("convert_string_internal: Conversion error: %s(%s)\n",
|
|
|
1524bc |
- reason, (const char *)src));
|
|
|
1524bc |
+ DBG_NOTICE("convert_string_internal: Conversion error: %s\n",
|
|
|
1524bc |
+ reason);
|
|
|
1524bc |
break;
|
|
|
1524bc |
default:
|
|
|
1524bc |
- DEBUG(0,("convert_string_internal: Conversion error: %s(%s)\n",
|
|
|
1524bc |
- reason, (const char *)src));
|
|
|
1524bc |
+ DBG_ERR("convert_string_internal: Conversion error: %s\n",
|
|
|
1524bc |
+ reason);
|
|
|
1524bc |
break;
|
|
|
1524bc |
}
|
|
|
1524bc |
/* smb_panic(reason); */
|
|
|
1524bc |
@@ -427,20 +427,22 @@ bool convert_string_talloc_handle(TALLOC_CTX *ctx, struct smb_iconv_handle *ic,
|
|
|
1524bc |
switch(errno) {
|
|
|
1524bc |
case EINVAL:
|
|
|
1524bc |
reason="Incomplete multibyte sequence";
|
|
|
1524bc |
- DEBUG(3,("convert_string_talloc: Conversion error: %s(%s)\n",reason,inbuf));
|
|
|
1524bc |
+ DBG_NOTICE("Conversion error: %s\n",
|
|
|
1524bc |
+ reason);
|
|
|
1524bc |
break;
|
|
|
1524bc |
case E2BIG:
|
|
|
1524bc |
reason = "output buffer is too small";
|
|
|
1524bc |
- DBG_NOTICE("convert_string_talloc: "
|
|
|
1524bc |
- "Conversion error: %s(%s)\n",
|
|
|
1524bc |
- reason, inbuf);
|
|
|
1524bc |
+ DBG_NOTICE("Conversion error: %s\n",
|
|
|
1524bc |
+ reason);
|
|
|
1524bc |
break;
|
|
|
1524bc |
case EILSEQ:
|
|
|
1524bc |
reason="Illegal multibyte sequence";
|
|
|
1524bc |
- DEBUG(3,("convert_string_talloc: Conversion error: %s(%s)\n",reason,inbuf));
|
|
|
1524bc |
+ DBG_NOTICE("Conversion error: %s\n",
|
|
|
1524bc |
+ reason);
|
|
|
1524bc |
break;
|
|
|
1524bc |
default:
|
|
|
1524bc |
- DEBUG(0,("Conversion error: %s(%s)\n",reason,inbuf));
|
|
|
1524bc |
+ DBG_ERR("Conversion error: %s\n",
|
|
|
1524bc |
+ reason);
|
|
|
1524bc |
break;
|
|
|
1524bc |
}
|
|
|
1524bc |
/* smb_panic(reason); */
|
|
|
1524bc |
--
|
|
|
1524bc |
2.17.1
|
|
|
1524bc |
|