From: Jeremy Allison <jra@samba.org>
Date: Thu, 11 Jul 2013 00:10:17 +0000 (-0700)
Subject: Fix bug #10010 - Missing integer wrap protection in EA list reading can cause server... 
X-Git-Tag: samba-4.0.8~2
X-Git-Url: http://git.samba.org/?p=samba.git;a=commitdiff_plain;h=b4bfcdf921aeee05c4608d7b48618fdfb1f134dc

Fix bug #10010 - Missing integer wrap protection in EA list reading can cause server to loop with DOS.

Ensure we never wrap whilst adding client provided input.

Signed-off-by: Jeremy Allison <jra@samba.org>
---

diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c
index 54e475d6143..f70fb36964e 100644
--- a/source3/smbd/nttrans.c
+++ b/source3/smbd/nttrans.c
@@ -993,7 +993,19 @@ struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t
 		if (next_offset == 0) {
 			break;
 		}
+
+		/* Integer wrap protection for the increment. */
+		if (offset + next_offset < offset) {
+			break;
+		}
+
 		offset += next_offset;
+
+		/* Integer wrap protection for while loop. */
+		if (offset + 4 < offset) {
+			break;
+		}
+
 	}
 
 	return ea_list_head;