From 38a62cf5f72495b99f10b74339c6f895504469aa Mon Sep 17 00:00:00 2001
From: Martin Schwenke <mschwenke@ddn.com>
Date: Sat, 30 May 2026 14:38:02 +1000
Subject: [PATCH 04/23] CVE-2026-58224: ctdb-protocol: Avoid DoS memory allocation

The pull loop already avoids out of bounds accesses beyond the end of
the buffer.  However, it does not avoid a DoS memory allocation due to
an unreasonably large array size.

Check that the number of specified array elements can be pulled from
buffer, which puts a reasonable upper bound on the subsequent memory
allocation.

Use an initialised dummy variable to avoid static analysers
complaining about uninitialised variables being passed.  Variable i
could be reused but that might be confusing, so leave any optimisation
to the compiler.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085

Reported-by: Martin Schwenke <mschwenke@ddn.com>
Reported-by: Also Andrew Tridgell (issue 22)
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
---
 ctdb/protocol/protocol_types.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/ctdb/protocol/protocol_types.c b/ctdb/protocol/protocol_types.c
index 0eb1923207e..86e1bc3954e 100644
--- a/ctdb/protocol/protocol_types.c
+++ b/ctdb/protocol/protocol_types.c
@@ -925,6 +925,7 @@ int ctdb_vnn_map_pull(uint8_t *buf, size_t buflen, TALLOC_CTX *mem_ctx,
 	struct ctdb_vnn_map *val;
 	size_t offset = 0, np;
 	uint32_t i;
+	uint32_t dummy = 0;
 	int ret;
 
 	val = talloc(mem_ctx, struct ctdb_vnn_map);
@@ -950,6 +951,11 @@ int ctdb_vnn_map_pull(uint8_t *buf, size_t buflen, TALLOC_CTX *mem_ctx,
 		goto done;
 	}
 
+	if ((uint64_t)val->size * ctdb_uint32_len(&dummy) > buflen - offset) {
+		ret = EMSGSIZE;
+		goto fail;
+	}
+
 	val->map = talloc_array(val, uint32_t, val->size);
 	if (val->map == NULL) {
 		ret = ENOMEM;
-- 
2.43.0


