From 424c42226fa2deac56f5df8fd9b114b6ab0b144e Mon Sep 17 00:00:00 2001
From: Martin Schwenke <mschwenke@ddn.com>
Date: Sat, 30 May 2026 17:45:56 +1000
Subject: [PATCH 08/23] CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access

The count can't exceed the indata buffer size.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
---
 ctdb/server/ctdb_recover.c | 6 ++++++
 1 file changed, 6 insertions(+)

--- a/ctdb/server/ctdb_recover.c
+++ b/ctdb/server/ctdb_recover.c
@@ -1060,6 +1060,12 @@ int32_t ctdb_control_try_delete_records(
 		return -1;
 	}
 
+	if (reply->count >
+	    indata.dsize - offsetof(struct ctdb_marshall_buffer, data)) {
+		DBG_ERR("Invalid packet\n");
+		return -1;
+	}
+
 	ctdb_db = find_ctdb_db(ctdb, reply->db_id);
 	if (!ctdb_db) {
 		DEBUG(DEBUG_ERR,(__location__ " Unknown db 0x%08x\n", reply->db_id));
