From 817f926ee93f5a5fc536e676551eb9fc3edb80e0 Mon Sep 17 00:00:00 2001
From: Martin Schwenke <mschwenke@ddn.com>
Date: Sat, 30 May 2026 15:04:31 +1000
Subject: [PATCH 06/23] CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access

If a NUL terminator doesn't appear in the buffer then the database
name is not a valid string.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
---
 ctdb/server/ctdb_ltdb_server.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/ctdb/server/ctdb_ltdb_server.c b/ctdb/server/ctdb_ltdb_server.c
index 8d03062b97a..2433b39b836 100644
--- a/ctdb/server/ctdb_ltdb_server.c
+++ b/ctdb/server/ctdb_ltdb_server.c
@@ -1109,8 +1109,15 @@ int32_t ctdb_control_db_attach(struct ctdb_context *ctdb,
 	struct ctdb_db_context *db;
 	struct ctdb_node *node = ctdb->nodes[ctdb->pnn];
 	struct ctdb_client *client = NULL;
+	char *t = NULL;
 	uint32_t opcode;
 
+	t = memchr(indata.dptr, '\0', indata.dsize);
+	if (t == NULL) {
+		DBG_ERR("Invalid packet\n");
+		return -1;
+	}
+
 	if (ctdb->tunable.allow_client_db_attach == 0) {
 		DEBUG(DEBUG_ERR, ("DB Attach to database %s denied by tunable "
 				  "AllowClientDBAccess == 0\n", db_name));
-- 
2.43.0


