Fix for CVE-2007-4572

== Subject:     Stack buffer overflow in nmbd's logon
==              request processing.
==
== CVE ID#:     CVE-2007-4572
==
== Versions:    Samba 3.0.0 - 3.0.26a (inclusive)

...
Samba developers have discovered what is believed to be
a non-exploitable buffer over in nmbd during the processing
of GETDC logon server requests.  This code is only used
when the Samba server is configured as a Primary or Backup
Domain Controller.

4 files changed, 81 insertions, 17 deletions

diff --git a/source/lib/charcnv.c b/source/lib/charcnv.c
index 8d5fbc8118d..2341429b9af 100644
--- a/source/lib/charcnv.c
+++ b/source/lib/charcnv.c
@@ -872,9 +872,9 @@ size_t push_ascii(void *dest, const char *src, size_t dest_len, int flags)
 	size_t src_len = strlen(src);
 	pstring tmpbuf;
 
-	/* treat a pstring as "unlimited" length */
+	/* No longer allow a length of -1 */
 	if (dest_len == (size_t)-1)
-		dest_len = sizeof(pstring);
+		smb_panic("push_ascii - dest_len == -1");
 
 	if (flags & STR_UPPER) {
 		pstrcpy(tmpbuf, src);
diff --git a/source/libsmb/ntlmssp_parse.c b/source/libsmb/ntlmssp_parse.c
index e71504867e9..38a65d3462a 100644
--- a/source/libsmb/ntlmssp_parse.c
+++ b/source/libsmb/ntlmssp_parse.c
@@ -152,7 +152,8 @@ BOOL msrpc_gen(DATA_BLOB *blob,
 			break;
 		case 'C':
 			s = va_arg(ap, char *);
-			head_ofs += push_string(NULL, blob->data+head_ofs, s, -1, 
+			n = str_charnum(s) + 1;
+			head_ofs += push_string(NULL, blob->data+head_ofs, s, n,
 						STR_ASCII|STR_TERMINATE);
 			break;
 		}
diff --git a/source/nmbd/nmbd_processlogon.c b/source/nmbd/nmbd_processlogon.c
index 1672b039792..05e82a4bf28 100644
--- a/source/nmbd/nmbd_processlogon.c
+++ b/source/nmbd/nmbd_processlogon.c
@@ -135,7 +135,9 @@ logons are not enabled.\n", inet_ntoa(p->ip) ));
 
 				fstrcpy(reply_name, "\\\\");
 				fstrcat(reply_name, my_name);
-				push_ascii_fstring(q, reply_name);
+				push_ascii(q,reply_name,
+						sizeof(outbuf)-PTR_DIFF(q, outbuf),
+						STR_TERMINATE);
 				q = skip_string(outbuf,sizeof(outbuf),q); /* PDC name */
 
 				SSVAL(q, 0, token);
@@ -231,7 +233,9 @@ logons are not enabled.\n", inet_ntoa(p->ip) ));
 				q += 2;
 
 				fstrcpy(reply_name,my_name);
-				push_ascii_fstring(q, reply_name);
+				push_ascii(q, reply_name,
+						sizeof(outbuf)-PTR_DIFF(q, outbuf),
+						STR_TERMINATE);
 				q = skip_string(outbuf,sizeof(outbuf),q); /* PDC name */
 
 				/* PDC and domain name */
@@ -239,8 +243,15 @@ logons are not enabled.\n", inet_ntoa(p->ip) ));
 					/* Make a full reply */
 					q = ALIGN2(q, outbuf);
 
-					q += dos_PutUniCode(q, my_name, sizeof(pstring), True); /* PDC name */
-					q += dos_PutUniCode(q, lp_workgroup(),sizeof(pstring), True); /* Domain name*/
+					q += dos_PutUniCode(q, my_name,
+						sizeof(outbuf) - PTR_DIFF(q, outbuf),
+						True); /* PDC name */
+					q += dos_PutUniCode(q, lp_workgroup(),
+						sizeof(outbuf) - PTR_DIFF(q, outbuf),
+						True); /* Domain name*/
+					if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 8) {
+						return;
+					}
 					SIVAL(q, 0, 1); /* our nt version */
 					SSVAL(q, 4, 0xffff); /* our lmnttoken */
 					SSVAL(q, 6, 0xffff); /* our lm20token */
@@ -376,9 +387,15 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n",
 
 					q += 2;
 
-					q += dos_PutUniCode(q, reply_name,sizeof(pstring), True);
-					q += dos_PutUniCode(q, ascuser, sizeof(pstring), True);
-					q += dos_PutUniCode(q, lp_workgroup(),sizeof(pstring), True);
+					q += dos_PutUniCode(q, reply_name,
+						sizeof(outbuf) - PTR_DIFF(q, outbuf),
+						True);
+					q += dos_PutUniCode(q, ascuser,
+						sizeof(outbuf) - PTR_DIFF(q, outbuf),
+						True);
+					q += dos_PutUniCode(q, lp_workgroup(),
+						sizeof(outbuf) - PTR_DIFF(q, outbuf),
+						True);
 				}
 #ifdef HAVE_ADS
 				else {
@@ -394,6 +411,9 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n",
 					get_mydnsdomname(domain);
 					get_myname(hostname);
 	
+					if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 8) {
+						return;
+					}
 					if (SVAL(uniuser, 0) == 0) {
 						SIVAL(q, 0, SAMLOGON_AD_UNK_R);	/* user unknown */
 					} else {
@@ -406,6 +426,9 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n",
 					q += 4;
 
 					/* Push Domain GUID */
+					if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < UUID_FLAT_SIZE) {
+						return;
+					}
 					if (False == secrets_fetch_domain_guid(domain, &domain_guid)) {
 						DEBUG(2, ("Could not fetch DomainGUID for %s\n", domain));
 						return;
@@ -421,12 +444,20 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n",
 					q1 = q;
 					while ((component = strtok(dc, "."))) {
 						dc = NULL;
-						size = push_ascii(&q[1], component, -1, 0);
+						if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 1) {
+							return;
+						}
+						size = push_ascii(&q[1], component,
+							sizeof(outbuf) - PTR_DIFF(q+1, outbuf),
+							0);
 						SCVAL(q, 0, size);
 						q += (size + 1);
 					}
 
 					/* Unk0 */
+					if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 4) {
+						return;
+					}
 					SCVAL(q, 0, 0);
 					q++;
 
@@ -436,44 +467,72 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n",
 					q += 2;
 
 					/* Hostname */
-					size = push_ascii(&q[1], hostname, -1, 0);
+					size = push_ascii(&q[1], hostname,
+							sizeof(outbuf) - PTR_DIFF(q+1, outbuf),
+							0);
 					SCVAL(q, 0, size);
 					q += (size + 1);
+
+					if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 3) {
+						return;
+					}
+
 					SCVAL(q, 0, 0xc0 | ((str_offset >> 8) & 0x3F));
 					SCVAL(q, 1, str_offset & 0xFF);
 					q += 2;
 
 					/* NETBIOS of domain */
-					size = push_ascii(&q[1], lp_workgroup(), -1, STR_UPPER);
+					size = push_ascii(&q[1], lp_workgroup(),
+							sizeof(outbuf) - PTR_DIFF(q+1, outbuf),
+							STR_UPPER);
 					SCVAL(q, 0, size);
 					q += (size + 1);
 
 					/* Unk1 */
+					if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 2) {
+						return;
+					}
 					SCVAL(q, 0, 0);
 					q++;
 
 					/* NETBIOS of hostname */
-					size = push_ascii(&q[1], my_name, -1, 0);
+					size = push_ascii(&q[1], my_name,
+							sizeof(outbuf) - PTR_DIFF(q+1, outbuf),
+							0);
 					SCVAL(q, 0, size);
 					q += (size + 1);
 
 					/* Unk2 */
+					if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 4) {
+						return;
+					}
 					SCVAL(q, 0, 0);
 					q++;
 
 					/* User name */
 					if (SVAL(uniuser, 0) != 0) {
-						size = push_ascii(&q[1], ascuser, -1, 0);
+						size = push_ascii(&q[1], ascuser,
+							sizeof(outbuf) - PTR_DIFF(q+1, outbuf),
+							0);
 						SCVAL(q, 0, size);
 						q += (size + 1);
 					}
 
 					q_orig = q;
 					/* Site name */
-					size = push_ascii(&q[1], "Default-First-Site-Name", -1, 0);
+					if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 1) {
+						return;
+					}
+					size = push_ascii(&q[1], "Default-First-Site-Name",
+							sizeof(outbuf) - PTR_DIFF(q+1, outbuf),
+							0);
 					SCVAL(q, 0, size);
 					q += (size + 1);
 
+					if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 18) {
+						return;
+					}
+
 					/* Site name (2) */
 					str_offset = q - q_orig;
 					SCVAL(q, 0, 0xc0 | ((str_offset >> 8) & 0x3F));
@@ -494,6 +553,10 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n",
 				}	
 #endif
 
+				if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 8) {
+					return;
+				}
+
 				/* tell the client what version we are */
 				SIVAL(q, 0, ((ntversion < 11) || (SEC_ADS != lp_security())) ? 1 : 13); 
 				/* our ntversion */
diff --git a/source/smbd/lanman.c b/source/smbd/lanman.c
index ff2044b2eb9..000b2f4c169 100644
--- a/source/smbd/lanman.c
+++ b/source/smbd/lanman.c
@@ -404,7 +404,7 @@ static void PackDriverData(struct pack_desc* desc)
 	SIVAL(drivdata,0,sizeof drivdata); /* cb */
 	SIVAL(drivdata,4,1000);	/* lVersion */
 	memset(drivdata+8,0,32);	/* szDeviceName */
-	push_ascii(drivdata+8,"NULL",-1, STR_TERMINATE);
+	push_ascii(drivdata+8,"NULL",32, STR_TERMINATE);
 	PACKl(desc,"l",drivdata,sizeof drivdata); /* pDriverData */
 }