CVE-2020-10704: libcli ldap_message: Add search size limits to ldap_decode
authorGary Lockyer <gary@catalyst.net.nz>
Tue, 7 Apr 2020 20:49:23 +0000 (08:49 +1200)
committerGary Lockyer <gary@samba.org>
Mon, 4 May 2020 02:59:32 +0000 (02:59 +0000)
commit3149ea0a8aada3b03d1ca0af2e3a0f6304cda43b
treefec0faa865f27affacdae3036c1c5e2daf6655fd
parent28ee4acc8347299cb41119012d9256d48c92cc5c
CVE-2020-10704: libcli ldap_message: Add search size limits to ldap_decode

Add search request size limits to ldap_decode calls.

The ldap server uses the smb.conf variable
"ldap max search request size" which defaults to 250Kb.
For cldap the limit is hard coded as 4096.

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
docs-xml/smbdotconf/ldap/ldapmaxsearchrequest.xml [new file with mode: 0644]
lib/fuzzing/fuzz_ldap_decode.c
lib/param/loadparm.c
libcli/cldap/cldap.c
libcli/ldap/ldap_message.c
libcli/ldap/ldap_message.h
libcli/ldap/tests/ldap_message_test.c
source3/param/loadparm.c
source4/ldap_server/ldap_server.c
source4/libcli/ldap/ldap_client.c