42 lines
1.5 KiB
Diff
42 lines
1.5 KiB
Diff
From 7f7d430dc5ec9285a8d95b69c591ed0225a0f057 Mon Sep 17 00:00:00 2001
|
|
From: Thierry Bordaz <tbordaz@redhat.com>
|
|
Date: Wed, 15 Jul 2026 11:39:58 +0200
|
|
Subject: [PATCH] Issue CVE-2026-15722 - pre-authentication stack buffer
|
|
overflow
|
|
|
|
Bug description:
|
|
The function get_ruvelement_from_berval() in ldap/servers/plugins/replication/repl5_ruv.c
|
|
parses a replica ID from a Replica Update Vector (RUV) berval by copying digit
|
|
characters into a 16-byte stack buffer (ridbuff[RIDSTR_SIZE]). The copy loop
|
|
has no bounds check
|
|
it keeps writing as long as isdigit() returns true.
|
|
A berval with more than 16 digit characters in the replica ID position overflows the buffer.
|
|
|
|
Fix description:
|
|
if the berval contains more than RIDSTR_SIZE-1 digits it fails
|
|
|
|
fixes: TBD
|
|
|
|
Reviewed by: Mark Reynolds
|
|
---
|
|
ldap/servers/plugins/replication/repl5_ruv.c | 3 +++
|
|
1 file changed, 3 insertions(+)
|
|
|
|
diff --git a/ldap/servers/plugins/replication/repl5_ruv.c b/ldap/servers/plugins/replication/repl5_ruv.c
|
|
index 40869c486..4df6ea135 100644
|
|
--- a/ldap/servers/plugins/replication/repl5_ruv.c
|
|
+++ b/ldap/servers/plugins/replication/repl5_ruv.c
|
|
@@ -1987,6 +1987,9 @@ get_ruvelement_from_berval(const struct berval *bval)
|
|
/* replica id must be here */
|
|
i = 0;
|
|
while (isdigit(bval->bv_val[urlbegin])) {
|
|
+ if (i >= RIDSTR_SIZE - 1) {
|
|
+ goto loser;
|
|
+ }
|
|
ridbuff[i] = bval->bv_val[urlbegin];
|
|
i++;
|
|
urlbegin++;
|
|
--
|
|
2.55.0
|
|
|