From 623cbadd46043ba6352d61a1fa9d8c17deb2b178 Mon Sep 17 00:00:00 2001
From: Martin Schwenke <mschwenke@ddn.com>
Date: Tue, 9 Jun 2026 21:54:20 +1000
Subject: [PATCH 12/23] CVE-2026-58224: ctdb-protocol: Always pull the specified number of
 bytes

The string should not contain a premature NUL terminator, which would
cause less than the specified number of bytes to be pulled.  If it
does, consume the specified number of bytes anyway.  The alternative
doesn't make sense.

Note that this is unlikely to be a security issue, where trailing data
in the string field causes the buffer to be overrun.  That would
require an additional protocol bug.  However, include this fix here
for posterity.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
---
 ctdb/protocol/protocol_basic.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ctdb/protocol/protocol_basic.c b/ctdb/protocol/protocol_basic.c
index 9cc52def644..750ea8f9fe7 100644
--- a/ctdb/protocol/protocol_basic.c
+++ b/ctdb/protocol/protocol_basic.c
@@ -319,7 +319,8 @@ int ctdb_stringn_pull(uint8_t *buf, size_t buflen, TALLOC_CTX *mem_ctx,
 	if (ret != 0) {
 		return ret;
 	}
-	offset += np;
+	/* Always consume the specified number bytes */
+	offset += u32;
 
 	*npull = offset;
 	return 0;
-- 
2.43.0


