pidl: check the size of pulled arrays of arrays
authorDouglas Bagnall <douglas.bagnall@catalyst.net.nz>
Wed, 30 Oct 2019 20:35:19 +0000 (09:35 +1300)
committerAndrew Bartlett <abartlet@samba.org>
Wed, 20 Nov 2019 04:41:28 +0000 (04:41 +0000)
commit1aec742575252d1efcc47a8e9023889bfb0e5709
treebbeaa1064d29d6f0ce30c7b4e34c3a3a4e92a7fa
parent536a84935ce7647f43528d6d376f6762c5e8eb78
pidl: check the size of pulled arrays of arrays

We were accidentally checking the memory just past the array instead of
checking each member.

This could have led to the size of some arrays not being checked.

Found by Michael Hanselmann using Honggfuzz and an fuzzer for Samba's
NDR layer.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13877

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm
selftest/knownfail.d/ndrdump [deleted file]