librpc: Do not follow a NULL pointer when calculating the size of a s…

…tructure Found by Douglas Bagnall using Hongfuzz and the new fuzz_ndr_X fuzzer. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876 Signed-off-by: Andrew Bartlett <[email protected]> Reviewed-by: Gary Lockyer <[email protected]>
bitwiseworks · Dec 12, 2019 · 362d70f · 362d70f
1 parent 5eb560d
commit 362d70f
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/librpc/ndr/ndr.c b/librpc/ndr/ndr.c
@@ -1492,6 +1492,11 @@ _PUBLIC_ size_t ndr_size_struct(const void *p, int flags, ndr_push_flags_fn_t pu
 	/* avoid recursion */
 	if (flags & LIBNDR_FLAG_NO_NDR_SIZE) return 0;
 
+	/* Avoid following a NULL pointer */
+	if (p == NULL) {
+		return 0;
+	}
+
 	ndr = ndr_push_init_ctx(NULL);
 	if (!ndr) return 0;
 	ndr->flags |= flags | LIBNDR_FLAG_NO_NDR_SIZE;

diff --git a/selftest/knownfail.d/ndrdump-NULL-struct b/selftest/knownfail.d/ndrdump-NULL-struct